CVE-2026-8788 - Vulnerability Details - OpenCVE

Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Rrwo	Net::statsd::lite

No data.

No data.

References

Link	Providers
https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.10.1/changes
https://www.cve.org/CVERecord?id=CVE-2026-46719

History

Tue, 19 May 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 18 May 2026 10:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Rrwo Rrwo net::statsd::lite
Vendors & Products		Rrwo Rrwo net::statsd::lite

Mon, 18 May 2026 08:00:00 +0000

Type	Values Removed	Values Added
Description		Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.
Title		Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections
Weaknesses		CWE-93
References		https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.10.1/changes https://www.cve.org/CVERecord?id=CVE-2026-46719

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2026-05-18T06:34:24.030Z

Updated: 2026-05-19T12:45:27.703Z

Reserved: 2026-05-17T12:01:20.592Z

Link: CVE-2026-8788

Vulnrichment

Updated: 2026-05-19T12:44:57.955Z

NVD

Status : Deferred

Published: 2026-05-18T08:16:15.320

Modified: 2026-05-19T14:16:50.060

Link: CVE-2026-8788

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8788", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-05-17T12:01:20.592Z", "datePublished": "2026-05-18T06:34:24.030Z", "dateUpdated": "2026-05-19T12:45:27.703Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-Statsd-Lite", "product": "Net::Statsd::Lite", "programRoutines": [{"name": "Net::Statsd::Lite::record_metric"}], "repo": "https://github.com/robrwo/Net-Statsd-Lite", "vendor": "RRWO", "versions": [{"lessThanOrEqual": "0.10.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-18T06:34:24.030Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.10.1/changes"}, {"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-46719"}], "solutions": [{"lang": "en", "value": "Upgrade to Net::Statsd::Lite version 0.10.1 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-05-14T00:00:00.000Z", "value": "Issue reported to CPANSec"}, {"lang": "en", "time": "2026-05-15T00:00:00.000Z", "value": "Author notified"}, {"lang": "en", "time": "2026-05-16T00:00:00.000Z", "value": "Fix released for CVE-2026-46719"}, {"lang": "en", "time": "2026-05-17T00:00:00.000Z", "value": "CVE-2026-8788 identified by author"}, {"lang": "en", "time": "2025-05-17T00:00:00.000Z", "value": "Fix released for CVE-2026-8788"}], "title": "Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections", "workarounds": [{"lang": "en", "value": "In version 0.10.0, use the secure_set_add method which logs an HMAC digest of the value instead of the raw value.\n\nValidate that all values sent to the client based on untrusted data do not contain metric injections."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-19T12:45:22.290912Z", "id": "CVE-2026-8788", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T12:45:27.703Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-8788", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T12:45:22.290912Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T12:44:57.955Z"}}], "cna": {"title": "Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/robrwo/Net-Statsd-Lite", "vendor": "RRWO", "product": "Net::Statsd::Lite", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.10.0"}], "packageName": "Net-Statsd-Lite", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::Statsd::Lite::record_metric"}]}], "timeline": [{"lang": "en", "time": "2026-05-14T00:00:00.000Z", "value": "Issue reported to CPANSec"}, {"lang": "en", "time": "2026-05-15T00:00:00.000Z", "value": "Author notified"}, {"lang": "en", "time": "2026-05-16T00:00:00.000Z", "value": "Fix released for CVE-2026-46719"}, {"lang": "en", "time": "2026-05-17T00:00:00.000Z", "value": "CVE-2026-8788 identified by author"}, {"lang": "en", "time": "2025-05-17T00:00:00.000Z", "value": "Fix released for CVE-2026-8788"}], "solutions": [{"lang": "en", "value": "Upgrade to Net::Statsd::Lite version 0.10.1 or later."}], "references": [{"url": "https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.10.1/changes", "tags": ["release-notes"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719", "tags": ["related"]}], "workarounds": [{"lang": "en", "value": "In version 0.10.0, use the secure_set_add method which logs an HMAC digest of the value instead of the raw value.\n\nValidate that all values sent to the client based on untrusted data do not contain metric injections."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-18T06:34:24.030Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8788", "state": "PUBLISHED", "dateUpdated": "2026-05-19T12:45:27.703Z", "dateReserved": "2026-05-17T12:01:20.592Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-05-18T06:34:24.030Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}