CVE-2026-11373 Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections
Attackers can inject newlines and control characters into metric names and values, corrupting statsite data streams.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11373?
CVE-2026-11373 is a critical vulnerability in JASEI Net::Statsite::Client, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections.
Net::Statsite::Client is a client for the statsite protocol, which is a variant of statsd.
Newlines are not removed from metric names, allowing metric injections.
Values are not sanitised for newlines or other protocol control characters such as colons or pipes, allowing metric injections.
Which versions are affected by CVE-2026-11373?
How do I fix CVE-2026-11373?
No fix has been published for CVE-2026-11373 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-11373 being exploited?
There is no known exploitation of CVE-2026-11373 in the wild and no public exploit code.
Sources
Also known as GHSA-g5q2-6jvc-qfhh.