CVE-2026-46719: Net::Statsd::Lite Metric Injection Flaw

CVE-2026-46719 Overview

CVE-2026-46719 is a metric injection vulnerability in the Net::Statsd::Lite Perl module before version 0.9.0. The module failed to validate metric names for newline, colon (:), or pipe (|) characters before transmitting them over the statsd protocol. Applications that constructed metric names from untrusted input could be coerced into emitting attacker-controlled statsd metrics. The flaw is categorized as [CWE-93] (Improper Neutralization of CRLF Sequences) and affects any Perl application using the vulnerable module to publish telemetry derived from user-supplied data.

Critical Impact

Attackers supplying crafted metric names can inject arbitrary statsd metrics, corrupting monitoring data, triggering false alerts, or masking malicious activity from observability pipelines.

Affected Products

• Net::Statsd::Lite Perl module versions prior to 0.9.0
• Perl applications consuming untrusted input as statsd metric names
• Observability pipelines ingesting metrics from vulnerable producers

Discovery Timeline

• 2026-05-16 - CVE-2026-46719 published to NVD
• 2026-05-16 - OSS-Security mailing list advisory published
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-46719

Vulnerability Analysis

The statsd line protocol delimits metric fields with the colon and pipe characters and separates distinct metrics with newlines. Net::Statsd::Lite constructed outbound UDP packets by concatenating caller-supplied metric names directly into the protocol payload without sanitization. An attacker who controlled any portion of a metric name could embed protocol delimiters to terminate the legitimate metric and append additional metric records within the same datagram.

The consequence depends on downstream consumers. A statsd daemon parses each injected line as an independent metric, which means the attacker can write arbitrary counters, gauges, or timers into the monitoring backend. This enables manipulation of dashboards, suppression of alerting thresholds, or pollution of long-term metric storage.

Root Cause

The Net::Statsd::Lite send routines treated metric names as opaque strings and performed no neutralization of the protocol's reserved characters: \n, :, and |. The fix in version 0.9.0 introduces explicit validation that rejects metric names containing these characters before serialization.

Attack Vector

Exploitation requires that an application pass attacker-influenced data into a Net::Statsd::Lite client call as part of the metric name. Common patterns include incrementing counters keyed by HTTP route, username, tenant identifier, or other request-derived values. No authentication to the statsd server is needed because the injection occurs at the producer.

# Security patch in Changes - Validate metrics against protocol injection

 Revision history for Net-Statsd-Lite
 
 {{$NEXT}}
+  [Security]
+  - Metrics names are now validated to ensure they do not contain newlines, ":" or "|" characters that
+    might allow metric injection. CVE-2026-46719
+
   [Documentation]
   - Added a security policy.

Source: GitHub Patch Commit

Detection Methods for CVE-2026-46719

Indicators of Compromise

• Unexpected statsd metric names appearing in monitoring backends, particularly those containing fragments of HTTP parameters or user input
• Bursts of unfamiliar counters or gauges originating from application hosts running Perl services
• UDP packets to statsd collectors containing multiple newline-separated metrics where the application normally emits one per call

Detection Strategies

• Audit application source code for calls into Net::Statsd::Lite that pass request-derived values as metric names
• Inspect statsd collector logs for metric names containing unusual byte sequences, encoded delimiters, or anomalously high cardinality
• Compare deployed Net::Statsd::Lite module versions against 0.9.0 across Perl hosts using CPAN inventory tooling

Monitoring Recommendations

• Alert on sudden growth in unique metric name cardinality from a single producer host
• Capture and review UDP egress to statsd ports (default 8125) for malformed protocol lines
• Track application logs that record metric emission to correlate suspicious names with the originating HTTP request

How to Mitigate CVE-2026-46719

Immediate Actions Required

• Upgrade Net::Statsd::Lite to version 0.9.0 or later on all Perl application hosts
• Inventory applications that build metric names from untrusted input and review for prior exposure
• Rotate or invalidate any monitoring-driven automated actions that may have been triggered by injected metrics

Patch Information

The maintainer released Net::Statsd::Lite v0.9.0, which validates metric names and rejects those containing newlines, colons, or pipes. See the MetaCPAN Release Changes and the GitHub Patch Commit for full details. The OpenWall OSS-Security Update provides the original disclosure.

Workarounds

• Sanitize all caller-supplied strings to remove \n, :, and | before passing them as metric names
• Wrap Net::Statsd::Lite calls in an application-level helper that allowlists metric name characters (for example, [A-Za-z0-9_.-])
• Avoid using untrusted identifiers such as usernames or URL paths directly as metric name components

# Configuration example - upgrade via cpanm
cpanm Net::Statsd::Lite@0.9.0

# Verify installed version
perl -MNet::Statsd::Lite -e 'print $Net::Statsd::Lite::VERSION, "\n"'