CVE-2026-11373

Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for the statsite protocol, which is a variant of statsd. Newlines are not removed from metric names, allowing metric injections. Values are not sanitised for newlines or other protocol control characters such as colons or pipes, allowing metric injections.

CVSS 3.1

9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-25)

CWEs

CWE-93, CWE-150

Published

2026-06-22

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

References

• http://armon.github.io/statsite
• https://metacpan.org/release/JASEI/Net-Statsite-Client-1.1.0/view/lib/Net/Statsite/Client.pm
• https://security.metacpan.org/patches/N/Net-Statsite-Client/1.1.0/CVE-2026-11373-r1.patch
• https://www.cve.org/CVERecord?id=CVE-2026-46719
• https://www.cve.org/CVERecord?id=CVE-2026-46720

Check your stackJSON