PT-2026-41648 · Cpan · Net::Statsd::Lite

CVE-2026-8788 · Published 2026-05-18 · Updated 2026-06-19

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Net::Statsd::Lite versions prior to 0.10.0

Description Net::Statsd::Lite for Perl allows metric injections because the set add() function does not validate values for newlines, colons, or pipes. This allows metrics generated from untrusted sources to inject additional statsd metrics.

Recommendations Update to version 0.10.0 or later. As a temporary workaround, restrict the use of the set add() function with untrusted input.

Exploit

Fix

Weakness Enumeration

CWE-93

CWE-150

Related Identifiers

CVE-2026-8788

Affected Products

Net::Statsd::Lite

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8788.json · Exploit
• https://cve.org/CVERecord?id=CVE-2026-46719 · Security Note
• https://osv.dev/vulnerability/CVE-2026-8788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8788 · Security Note
• https://github.com/robrwo/Net-Statsd-Lite · Note
• https://twitter.com/oss_security/status/2056947352804438157 · Twitter Post
• https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.10.1/changes · Note
• https://twitter.com/CVEarity/status/2056410338153943474 · Twitter Post
• https://t.me/CVEtracker/54109 · Telegram Post
• https://cpan.org/modules · Note
• https://t.me/cveNotify/171085 · Telegram Post