Metric Injection Vulnerability in Net::Statsite::Client for Perl
CVE-2026-11373

9.1CRITICAL

Key Information:

Vendor

Jasei

Status
Net::statsite::client
Vendor
CVE Published:
22 June 2026

What is CVE-2026-11373?

The Net::Statsite::Client for Perl is susceptible to metric injection due to inadequate sanitization of metric names, where newlines and other control characters such as colons or pipes are not properly filtered. This flaw enables attackers to manipulate metrics sent to the statsite protocol, potentially resulting in erroneous data storage or system behavior. Users of versions through 1.1.0 should be aware of this security issue and consider applying available patches to mitigate the risk.

Affected Version(s)

Net::Statsite::Client 0 <= 1.1.0

References

https://metacpan.org/release/JASEI/Net-Statsite-Client-1....
https://security.metacpan.org/patches/N/Net-Statsite-Clie...
patch
http://armon.github.io/statsite
technical-description

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.