CVE Intelligence
Analysis AI-assisted

CVE-2026-11373: Net::Statsite::Client for Perl: metric injection via newlines and control characters

CVE-2026-11373 affects Net::Statsite::Client for Perl through version 1.1.0, a client for the statsite protocol. Newlines are not removed from metric names, and values are not sanitised for newlines, colons or pipes, which allows metric injection. The record rates it critical with CVSS 3.1 score 9.1, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-11373 is a metric injection weakness in Net::Statsite::Client, a Perl client for the statsite protocol, which is a variant of statsd. According to the record, newlines are not stripped from metric names, and values are not sanitised for newlines or other protocol control characters such as colons and pipes. The record maps the weakness to CWE-93, improper neutralization of CRLF sequences.

Impact

  • The record links the flaw to metric injection, meaning crafted input can add or alter metric entries sent to a statsite-compatible backend.
  • The CVSS 3.1 vector reports a network attack vector, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with no availability impact. The record gives a score of 9.1.
  • The record does not describe concrete consequences for monitoring data or dependent systems. Any such consequence would be an inference.

Affected products and versions

  • Net::Statsite::Client for Perl, versions through 1.1.0, according to the description.
  • The record contains no structured list of affected or fixed versions.
  • Release page referenced in the record: MetaCPAN release 1.1.0.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalogue. No confirmed exploitation in the wild appears in the sources consulted. EPSS data is absent from the record.

Remediation and mitigation

  • Identify whether your applications or scripts use Net::Statsite::Client and which version is installed.
  • The record lists a patch file for version 1.1.0: security.metacpan.org patch. The record does not describe its contents or confirm it as an official fix, so verify it with the maintainer before relying on it.
  • Until a fix is verified, treat any metric name or value derived from untrusted input as hostile. Validate or reject newline and control characters at the application boundary.
  • Limit which components can write metrics to statsite listeners, and restrict network access to those listeners.

Detection guidance

  • Review application code that builds metric names or tags from user-controlled data.
  • Look for metric names or series that do not match the expected naming scheme, and for values that appear split across lines in ingestion logs.
  • Monitor metric volumes for sudden anomalies that could indicate injected entries.

Limitations of the available information

  • The record does not state a fixed version.
  • The affected range is given only as through 1.1.0.
  • The references include related CVE IDs CVE-2026-46719, CVE-2026-46720 and CVE-2026-46739, but the record does not explain their relationship to this CVE.
  • EPSS and SSVC data are absent, and the CVSS entry is the only severity information available.

Frequently asked questions

What does CVE-2026-11373 affect?

According to the record, it affects Net::Statsite::Client for Perl in versions through 1.1.0. The record does not include a structured list of affected or fixed versions.

Is this CVE known to be exploited?

The record does not list it in the CISA KEV catalogue, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.