CVE-2026-8788

Summary

Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.

The values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

Note that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.

Affected Software

Weaknesses

• CWE-93: CWE-93 Improper Neutralization of CRLF Sequences
• CWE-150: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences

Workarounds

In version 0.10.0, use the secure_set_add method which logs an HMAC digest of the value instead of the raw value.

Validate that all values sent to the client based on untrusted data do not contain metric injections.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.10.1/changes
• https://www.cve.org/CVERecord?id=CVE-2026-46719

• ←Previous
• Next→