CVE-2026-50637: Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections

Synopsis

This is a metric injection vulnerability in the Perl module Metrics::Any::Adapter::Statsd, affecting all versions before 0.04. The module's send method does not validate metric names or values before writing them to the statsd UDP protocol, which uses newlines as a record separator and colons and pipes as field delimiters. An attacker who can influence metric names or values sent over the network, with no authentication required, can inject arbitrary statsd metrics, corrupting or forging monitoring data. A patched-image rebuild at version 0.04 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the service over the network to supply crafted metric names or values that the vulnerable send method forwards to the statsd endpoint.

• AuthenticationNot required

  No credentials or session are required; the vulnerability is reachable by any party that can influence the metric inputs before they are passed to the adapter.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or operator on the target system.

• Attack complexityDetail

  The exploit is reliable and condition-free: the attacker only needs to supply a metric name or value containing a newline, colon, or pipe character, with no timing or environment constraints.

Blast Radius

• Attacker injects forged statsd metric records into the monitoring pipeline, fabricating counter, gauge, or timer readings for arbitrary metric names.
• Legitimate metric data is silently overwritten or diluted, causing dashboards and alerting thresholds to reflect false values.
• Partial information disclosure occurs because the CVSS confidentiality impact is rated Low, meaning some metric namespace or naming-scheme details may be inferred from error responses or side effects.