CVE-2026-8788CWE-150CWE-93

Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections

High · published May 18, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
26.5
In the wild
Unconfirmed
What it is

Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.

The values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

Note that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00342 · 26.5th percentile
Weaknesses
CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences; CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-05-18T06:34Z
EPSS history
Timeline
  • 18 MAY 06:34Z
    Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections
    cvelistv5