PT-2026-41648 · Cpan · Net::Statsd::Lite

Published 2026-05-18 · Updated 2026-05-20 · CVE-2026-8788

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Net::Statsd::Lite versions prior to 0.10.0

Description Net::Statsd::Lite for Perl allows metric injections because the set add() function does not validate values for newlines, colons, or pipes. This allows metrics generated from untrusted sources to inject additional statsd metrics.

Recommendations Update to version 0.10.0 or later. As a temporary workaround, restrict the use of the set add() function with untrusted input.

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-8788

Affected Products

Net::Statsd::Lite

References · 6

• https://cve.org/CVERecord?id=CVE-2026-46719 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-8788 · Security Note
• https://twitter.com/CVEarity/status/2056410338153943474 · Twitter Post
• https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.10.1/changes · Note
• https://twitter.com/oss_security/status/2056947352804438157 · Twitter Post
• https://t.me/CVEtracker/54109 · Telegram Post