CVE-2026-50637 Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections

High 8.2 Published 10 Jun 2026 Updated 19 Jun 2026

Attackers can inject arbitrary metrics into Statsd servers via unsanitized input in the Perl Metrics::Any::Adapter::Statsd library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-50637?

CVE-2026-50637 is a high-severity vulnerability in PEVANS Metrics::Any::Adapter::Statsd, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections.

The statsd protocol (and extensions) allow mutiple metrics, separated by newlines, to be sent per packet.

The send method does not validate the contents of the metric names or values. If the names have newlines and statsd control characters (colon, pipe) then metric injections are possible.

Version 0.04 fixed this by modifying the _make method to block metric names with characters below ASCII 32 (which includes the newline), or colons or pipes.

Weakness: CWE-93, CWE-150

Which versions are affected by CVE-2026-50637?

It affects 1 product.

Products include Pevans Metrics\.

How do I fix CVE-2026-50637?

No fix has been published for CVE-2026-50637 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-50637 being exploited?

There is no known exploitation of CVE-2026-50637 in the wild and no public exploit code.

Sources

Also known as GHSA-q83q-ghhm-p7g4.