CVE-2026-46741: Etsy::StatsD versions through 1.002002 for Perl allow metric injections

Synopsis

Metric injection is a flaw in Etsy::StatsD (Perl), affecting all published versions through 1.002002. The library sends metrics to a StatsD backend without stripping newlines, colons, or pipe characters from metric names or values, so an attacker who controls any input used to build a metric can inject arbitrary additional StatsD metrics into the data stream. Successful exploitation allows an attacker to tamper with application metrics, corrupt monitoring data, or fabricate measurements that mask or misrepresent system behavior. HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as a fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker supplies crafted input remotely to influence metric names or values sent to the StatsD backend.

• AuthenticationNot required

  No credentials are needed; any unauthenticated party who can influence input processed into a metric name or value can trigger the injection.

• Victim interactionNot required

  No user action is required; the injection occurs automatically when the application processes attacker-controlled input and forwards it to StatsD.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, requiring no race conditions or special environmental setup beyond supplying input containing newlines, colons, or pipe characters.

Blast Radius

• Attacker injects fabricated metric names and values into the StatsD stream, overwriting or spoofing application performance and business measurements.
• Monitoring dashboards and alerting rules receive corrupted data, hiding real anomalies or triggering false alerts that obscure genuine incidents.
• If metric-based autoscaling or rate-limiting decisions rely on StatsD data, injected values can manipulate those automated responses.