CVE-2026-8788 Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections
Attackers can inject arbitrary statsd metrics via untrusted input in Net::Statsd::Lite due to missing validation of special characters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8788?
CVE-2026-8788 is a high-severity vulnerability in RRWO Net::Statsd::Lite, published on 18 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.
The values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
Note that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.
Which versions are affected by CVE-2026-8788?
How do I fix CVE-2026-8788?
No fix has been published for CVE-2026-8788 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-8788 being exploited?
There is no known exploitation of CVE-2026-8788 in the wild and no public exploit code.
Sources
Also known as GHSA-57h4-p8xg-x38x.