Security Advisories (1)
CVE-2026-11373 (2026-06-22)

Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for the statsite protocol, which is a variant of statsd. Newlines are not removed from metric names, allowing metric injections. Values are not sanitised for newlines or other protocol control characters such as colons or pipes, allowing metric injections.

NAME

Net::Statsite::Client - Object-Oriented Client for statsite server

SYNOPSIS

use Net::Statsite::Client;
my $statsite = Net::Statsite::Client->new(
    host   => 'localhost',
    prefix => 'test',
);

$statsite->increment('item'); #increment key test.item

DESCRIPTION

Net::Statsite::Client is based on Etsy::StatsD but with new - new interface and unique method.

METHODS

new (host => $host, port => $port, sample_rate => $sample_rate, prefix => $prefix)

Create a new instance.

host - hostname of statsite server (default: localhost)

port - port of statsite server (port: 8125)

sample_rate - rate of sends metrics (default: 1)

prefix - prefix metric name (default: '')

proto - protocol (default: 'udp')

timing(STAT, TIME, SAMPLE_RATE)

Log timing information (should be in miliseconds)

increment(STATS, SAMPLE_RATE)

Increment one of more stats counters.

decrement(STATS, SAMPLE_RATE)

Decrement one of more stats counters.

update(STATS, DELTA, SAMPLE_RATE)

Update one of more stats counters by arbitrary amounts.

unique(STATS, ITEM, SAMPLE_RATE)

Unique Set

For example if you need count of unique ip adresses (per flush interval) $stats->unique('ip.unique', $ip);

gauge(STATS, VALUE, SAMPLE_RATE)

Gauge Set (Gauge, similar to kv but only the last value per key is retained)

send(DATA, SAMPLE_RATE)

Sending logging data; implicitly called by most of the other methods.

CONTRIBUTING

the easiest way is use docker (avastsoftware/perl-extended - with Carton and Minilla)

or Carton and Minilla itself (commands after ../perl-extended)

carton (aka ruby bundle) for fetch dependency

docker run -v $PWD:/tmp/app -w /tmp/app avastsoftware/perl-extended carton

and minil test for tests and regenerate meta and readme

docker run -v $PWD:/tmp/app -w /tmp/app avastsoftware/perl-extended carton exec minil test

LICENSE

Copyright (C) Avast Software.

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

AUTHOR

Jan Seidl <seidl@avast.com>