/ 
Metrics-Any-Adapter-Statsd-0.01
/ Metrics::Any::Adapter::Statsd
Security Advisories (3)
CVE-2026-50637 (2026-06-10)

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions) allow mutiple metrics, separated by newlines, to be sent per packet. The send method does not validate the contents of the metric names or values. If the names have newlines and statsd control characters (colon, pipe) then metric injections are possible. Version 0.04 fixed this by modifying the _make method to block metric names with characters below ASCII 32 (which includes the newline), or colons or pipes.

CVE-2026-50638 (2026-06-10)

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapter::DogStatsd which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability. In addition, the _tags function does not check tags for newlines or statsd control characters. The tags can be used for metric injections.

CVE-2026-50639 (2026-06-10)

Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapter::SignalFx which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability. In addition, the _labels function does not check tags labels newlines or statsd control characters. The labels can be used for metric injections.

NAME

Metrics::Any::Adapter::Statsd - a metrics reporting adapter for statsd

SYNOPSIS

use Metrics::Any::Adapter 'Statsd';

DESCRIPTION

This Metrics::Any adapter type reports metrics to statsd via the local UDP socket. Each metric value reported will result in a new UDP packet being sent.

The location of the statsd server is set by two package variables, defaulting to

$Net::Statsd::HOST = "127.0.0.1";
$Net::Statsd::PORT = 8125

The configuration can be changed by setting new values.

METRIC HANDLING

Unlabelled counter, gauge and timing metrics are handled natively as you would expect for statsd; with multipart names being joined by periods (.).

Distribution metrics are emitted as two sub-named metrics by appending count and sum. The count metric in incremented by one for each observation and the sum by the observed amount.

Labels are not handled by this adapter and are thrown away. This will result in a single value being reported that accumulates the sum total across all of the label values. In the case of labelled gauges using the set_gauge_to method this will not be a useful value.

For better handling of labelled metrics for certain services which have extended the basic statsd format to handle them, see:

TODO

  • Support non-one samplerates; emit only one-in-N packets with the @rate notation in the packet.

  • Optionally support one dimension of labelling by appending the conventional some.metric.by_$label.$value notation to it.

AUTHOR

Paul Evans <leonerd@leonerd.org.uk>