Executive brief
A Perl library used for sending application performance data to monitoring systems is vulnerable to metric injection. If an application uses untrusted input as a metric name or value, an attacker could inject fake data or corrupt existing monitoring reports. This could lead to inaccurate business analytics or hide malicious activity from system administrators.
Technical details
The Metrics::Any::Adapter::Statsd library fails to validate metric names and values before sending them via the StatsD protocol. Because the protocol uses newlines to separate multiple metrics in a single packet, an attacker can inject CRLF sequences (newline characters) along with StatsD control characters like colons and pipes. This allows for the injection of arbitrary metric data into the monitoring stream. The vulnerability is rooted in the 'send' method's lack of input sanitization. Version 0.04 addresses this by modifying the internal '_make' method to block characters below ASCII 32, colons, and pipes in metric names.
Affected products
- Perl CPAN Metrics::Any::Adapter::Statsd before 0.04
Timeline
- 2026-06-06: patched: Version 0.04 released to address the injection vulnerability.
- 2026-06-10: disclosed: CVE-2026-50637 published.