Vulnerability · Published Jun 22, 2026 · Assigned by CPANSec

CVE-2026-11373Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections

Critical 9.1

In plain English

A critical-severity security flaw in Net::Statsite::Client from JASEI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.6%top 52.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for the statsite protocol, which is a variant of statsd. Newlines are not removed from metric names, allowing metric injections. Values are not sanitised for newlines or other protocol control characters such as colons or pipes, allowing metric injections.

Affected products (as reported)

Vendor	Product	Versions
JASEI	Net::Statsite::Client	0 – through 1.1.0

Weakness: CWE-93, CWE-150 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

In plain English

Official description

Affected products (as reported)

References