CVE-2026-11373: Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections

Synopsis

This is a metric injection vulnerability in Net::Statsite::Client, a Perl client library for the statsite (statsd-variant) protocol, affecting all versions through 1.1.0. The library fails to strip newlines from metric names and fails to sanitize metric values for newlines, colons, and pipe characters, which are control characters in the statsite protocol. An attacker who can influence metric names or values sent through the library can inject arbitrary forged metrics into the statsite data stream, corrupting monitoring data or masking malicious activity. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send data over the network to any service or pipeline that passes attacker-influenced metric names or values through the affected library.

• AuthenticationNot required

  No authentication is required; the injection is possible through any code path that accepts external input and forwards it to Net::Statsite::Client without prior login.

• Victim interactionNot required

  No user interaction is needed; exploitation is fully automated once attacker-controlled input reaches the library.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and requires no special conditions, race conditions, or environmental setup beyond supplying crafted input containing newlines or protocol control characters.

Blast Radius

• An attacker can inject forged metric records into the statsite data stream, polluting dashboards and alerting pipelines with fabricated counters, timers, or gauges.
• Injected metrics can overwrite or shadow legitimate metrics, masking real performance degradation or security-relevant events from operators.
• Confidential metric names or sampling logic derived from internal service names may be partially disclosed through crafted injection payloads that echo data back through the metrics pipeline.
• Persistent injection can degrade the integrity of historical metrics stored downstream, corrupting capacity planning, SLO tracking, or incident post-mortems.