CVE-2026-8788: Net::Statsd::Lite Metric Injection Flaw

CVE-2026-8788 Overview

CVE-2026-8788 affects Net::Statsd::Lite versions through 0.10.0 for Perl. The library fails to validate input passed to the set_add method, allowing metric injection attacks. Untrusted input containing newlines, colons, or pipe characters can inject arbitrary statsd metrics into the data stream. This issue is classified under [CWE-93] (Improper Neutralization of CRLF Sequences). The flaw mirrors an earlier issue, CVE-2026-46719, which addressed the same class of injection in metric names in version 0.9.0. Applications forwarding user-controlled values to set_add are exposed to metric corruption and downstream monitoring integrity issues.

Critical Impact

Attackers can inject arbitrary statsd metrics through unvalidated input to set_add, corrupting telemetry pipelines and undermining monitoring data integrity.

Affected Products

• Net::Statsd::Lite Perl module versions through 0.10.0
• Applications using set_add with untrusted input
• Monitoring pipelines ingesting metrics from affected library versions

Discovery Timeline

• 2026-05-18 - CVE-2026-8788 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-8788

Vulnerability Analysis

The vulnerability resides in the set_add method of Net::Statsd::Lite. Statsd uses a line-oriented text protocol where metrics are delimited by newlines and field components are separated by colons and pipes. The library passes values from set_add directly into the protocol buffer without neutralizing these delimiter characters. An attacker who controls a value supplied to set_add can terminate the current metric line and append additional metric definitions of their choosing. This affects all releases up to and including version 0.10.0. Version 0.9.0 previously addressed an analogous flaw in metric names tracked as CVE-2026-46719, but the fix did not extend to set values.

Root Cause

The root cause is missing input sanitization for control characters within the set_add code path. The library trusted set values implicitly while applying validation only to metric names. Newline (\n), colon (:), and pipe (|) characters retain their protocol semantics when forwarded to the statsd server, enabling injection.

Attack Vector

Exploitation requires the target application to pass attacker-influenced data, such as HTTP headers, usernames, or query parameters, into set_add. No authentication is required when the upstream application accepts unauthenticated input. The attacker crafts a payload containing newline characters followed by a forged statsd metric line. The library transmits the combined payload over UDP or TCP to the statsd collector, which parses each line as a discrete metric. See the MetaCPAN release notes for the upstream fix details.

Detection Methods for CVE-2026-8788

Indicators of Compromise

• Unexpected metric names appearing in statsd collectors that do not match any application-defined counters, gauges, or sets
• Spikes in metric cardinality originating from hosts running affected Perl applications
• Statsd log entries containing embedded newline-separated metric definitions traceable to user input fields

Detection Strategies

• Audit application source code for calls to Net::Statsd::Lite::set_add that pass user-controlled values without sanitization
• Inspect statsd server logs for malformed metric lines or metrics with names containing characters not used by the application
• Run dependency scanners against cpanfile, Makefile.PL, and META.json to flag Net::Statsd::Lite versions at or below 0.10.0

Monitoring Recommendations

• Baseline expected metric names per service and alert on the introduction of unknown metric identifiers
• Log raw statsd packets at the collector for forensic review when anomalous metrics appear
• Track the volume of distinct set members per metric and alert on sudden growth

How to Mitigate CVE-2026-8788

Immediate Actions Required

• Upgrade Net::Statsd::Lite to version 0.10.1 or later, which validates set values for newlines, colons, and pipes
• Inventory all Perl applications using Net::Statsd::Lite and confirm the patched version is deployed
• Sanitize or reject user-supplied input before passing it to any statsd client method

Patch Information

The maintainer released Net::Statsd::Lite v0.10.1 to address this issue. Refer to the MetaCPAN release notes for full change details. Update through CPAN using cpanm Net::Statsd::Lite@0.10.1 or pin the version in your dependency manifest.

Workarounds

• Wrap calls to set_add with a custom filter that strips or rejects \n, :, and | characters from values
• Restrict statsd ingestion to trusted network segments and authenticated sources where possible
• Apply schema validation at the statsd collector to drop metrics with names outside an allowlist

# Upgrade the affected module via cpanminus
cpanm Net::Statsd::Lite@0.10.1

# Verify the installed version
perl -MNet::Statsd::Lite -e 'print $Net::Statsd::Lite::VERSION, "\n"'