CVE-2026-11373: Net::Statsite::Client Injection Vulnerability

CVE-2026-11373 Overview

CVE-2026-11373 affects Net::Statsite::Client versions through 1.1.0 for Perl. The module is a client for the statsite protocol, a variant of statsd used to ship application metrics over the network. The library fails to sanitize metric names and values, allowing attackers to inject arbitrary statsite protocol directives through newline, colon, and pipe characters. An attacker who can influence metric names or values passed to the client can forge, modify, or suppress metrics sent to the statsite server. This vulnerability is categorized under [CWE-93] Improper Neutralization of CRLF Sequences.

Critical Impact
Unsanitized newlines and protocol control characters in metric names and values enable remote attackers to inject arbitrary statsite metrics, corrupting telemetry and downstream monitoring pipelines.

Affected Products

Net::Statsite::Client for Perl, versions up to and including 1.1.0
Applications consuming the JASEI distribution of Net-Statsite-Client from CPAN
Monitoring pipelines that ingest statsite or statsd metrics produced by this client

Discovery Timeline

2026-06-22 - CVE-2026-11373 published to the National Vulnerability Database (NVD)
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-11373

Vulnerability Analysis

The statsite protocol, like statsd, is a line-oriented text protocol. Each metric is transmitted as a single line in the form name:value|type, with the newline character acting as the record separator. Net::Statsite::Client constructs these lines by concatenating user-supplied input without filtering control characters.

Because metric names retain embedded newlines, an attacker who controls part of a metric name can append additional metric lines to a single send operation. Metric values are also passed through without sanitization, so the colon (:), pipe (|), and newline characters can all be used to break out of the intended field and inject new fields or new records.

The practical effect is forged telemetry. Attackers can inflate counters, suppress alerting thresholds, poison aggregated dashboards, or inject metrics impersonating other services that share the same statsite collector. Where metrics drive autoscaling, billing, or security alerting, downstream actions can be manipulated.

Root Cause

The root cause is missing input neutralization in the metric construction path of Net/Statsite/Client.pm. Newlines are not stripped from metric names, and values are not validated against the protocol delimiters :, |, and \n. This matches the [CWE-93] CRLF injection pattern applied to a UDP/TCP line-oriented metrics protocol.

Attack Vector

Exploitation requires that attacker-controlled data reach a metric name or value argument. Common patterns include logging HTTP request paths, user agents, usernames, or error strings into metric names or tags. The vulnerability is network-reachable in the sense that the injected data typically arrives over the network and is then emitted to the statsite collector by the application. No authentication or user interaction is required on the metrics client itself. Refer to the MetaCPAN Client Documentation and the MetaCPAN Patch for CVE-2026-11373 for the corrected sanitization logic.

Detection Methods for CVE-2026-11373

Indicators of Compromise

Statsite or statsd traffic containing embedded \n, \r, or unexpected : and | characters within metric name fields.
Sudden appearance of metric names that mirror user-controllable inputs such as URL paths, headers, or form fields.
Anomalous spikes or drops in counters that do not correlate with application traffic volumes.

Detection Strategies

Inspect outbound UDP/TCP packets to the statsite collector and flag payloads containing multiple metric lines that originate from a single application send call.
Audit application source for direct interpolation of request data into Net::Statsite::Client method arguments such as increment, timing, and gauge.
Compare deployed CPAN module versions against version 1.1.0 and earlier using software composition analysis on cpanfile, Makefile.PL, or META.json.

Monitoring Recommendations

Enable verbose logging on the statsite collector and alert on malformed metric lines or unexpected metric name patterns.
Baseline the set of known metric names emitted by each service and alert on new high-cardinality names.
Correlate metric anomalies with upstream HTTP logs to identify the injection source.

How to Mitigate CVE-2026-11373

Immediate Actions Required

Upgrade Net::Statsite::Client to a release that incorporates the MetaCPAN Patch for CVE-2026-11373.
Audit all call sites that pass external input into metric names or values and add explicit input validation.
Restrict network access to the statsite collector so only trusted application hosts can submit metrics.

Patch Information

A patch is published at the MetaCPAN security tracker as CVE-2026-11373-r1.patch. The fix removes newline characters from metric names and strips protocol control characters (:, |, \n) from metric values. Until a fixed CPAN release is installed, apply the patch directly against the local copy of lib/Net/Statsite/Client.pm.

Workarounds

Wrap calls to Net::Statsite::Client with an application-level sanitizer that rejects or replaces \r, \n, :, and | in any caller-supplied metric name or value.
Use allow-lists of permitted metric names rather than passing dynamic strings derived from user input.
Segment the statsite collector onto an isolated network and authenticate emitting services where the deployment supports it.

bash

# Configuration example: apply the upstream patch to an installed copy
cd $(perl -MNet::Statsite::Client -e 'print $INC{"Net/Statsite/Client.pm"}' | xargs dirname)
curl -O https://security.metacpan.org/patches/N/Net-Statsite-Client/1.1.0/CVE-2026-11373-r1.patch
patch -p1 < CVE-2026-11373-r1.patch