CVE-2026-50637CWE-150CWE-93

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections

High · published June 10, 2026

CVSS v3.1
8.2
EPSS
1%
Percentile
42.1
In the wild
Unconfirmed
What it is

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections.

The statsd protocol (and extensions) allow mutiple metrics, separated by newlines, to be sent per packet.

The send method does not validate the contents of the metric names or values. If the names have newlines and statsd control characters (colon, pipe) then metric injections are possible.

Version 0.04 fixed this by modifying the _make method to block metric names with characters below ASCII 32 (which includes the newline), or colons or pipes.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00503 · 42.1th percentile
Weaknesses
CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences; CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-06-10T18:32Z
EPSS history
Timeline
  • 10 JUN 18:32Z
    Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections
    cvelistv5