PT-2026-51292 · Cpan · Net::Statsite::Client

Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-11373

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Net::Statsite::Client versions prior to 1.1.1

Description Net::Statsite::Client, a client for the statsite protocol (a variant of statsd), allows metric injections. This occurs because newlines are not removed from metric names, and values are not sanitized for newlines or other protocol control characters, such as colons or pipes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-93

CWE-150

Related Identifiers

CVE-2026-11373

Affected Products

Net::Statsite::Client

References · 10

• https://cve.org/CVERecord?id=CVE-2026-46739 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-11373 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-46720 · Security Note
• https://security.metacpan.org/patches/N/Net-Statsite-Client/1.1.0/CVE-2026-11373-r1.patch · Patch
• https://cve.org/CVERecord?id=CVE-2026-46719 · Security Note
• https://twitter.com/infoflowcloud/status/2069092157512683975 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2069038722054488422 · Twitter Post
• http://armon.github.io/statsite · Note
• https://metacpan.org/release/JASEI/Net-Statsite-Client-1.1.0/view/lib/Net/Statsite/Client.pm · Note
• https://twitter.com/CVEnew/status/2069090899494342809 · Twitter Post