Security Advisories (1)
CVE-2026-8788 (2026-05-18)

Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.

Changes for version v0.10.0 - 2026-05-16

  • Enhancements
    • Metrics names with any characters below ASCII 32 will be blocked.
    • Added the secure_set_add method for logging sensitive information.
  • Documentation
    • Updated the SECURITY CONSIDERATIONS section.
  • Tests
    • Removed duplicate author test.

Documentation

Modules

A lightweight StatsD client that supports multimetric packets