CVE-2026-11373 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-11373 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-11373 is a metric injection vulnerability in Net::Statsite::Client, a Perl client library for the statsite/statsd protocol, affecting all versions through 1.1.0.

Technical Detail

The flaw exists because the library fails to strip or sanitize newline characters from user-supplied metric data before transmitting it to the statsite server. An attacker who can influence metric names or values passed through the client can inject arbitrary newline-delimited commands or metrics into the statsite data stream, effectively manipulating server-side metric recording or potentially interfering with downstream processing pipelines. The primary impact is data integrity compromise and unauthorized metric injection; depending on how the statsite server and any downstream consumers process the injected data, secondary impacts such as log poisoning or protocol-level manipulation are plausible.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is assessed as none, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. There is no public proof-of-concept code or reported exploitation activity as of June 29, 2026.

Who Is Targeting This

No confirmed threat actor attribution exists for this vulnerability. Reported attribution carries no specific actor name, origin, or motivation, and is assessed at medium confidence with no public attribution identified. No specific threat actor has been linked to exploitation of this CVE at this time.

What To Do

Operators using Net::Statsite::Client in Perl applications should update to a patched version of the library once one is released by the maintainer, or audit and pin to a remediated release if available. In the interim, developers should implement input validation at the application layer to strip or reject newline characters (CR and LF) from any externally influenced metric names or values before passing them to the client. Review any application code that accepts user-controlled input and routes it through this library. Monitor statsite server logs for unexpected or malformed metric entries as a detection signal for attempted injection. Given the absence of active exploitation, this can be addressed through normal patch management cycles rather than emergency response procedures.