CVE-2026-8788

HighCVSS 7.3

Published: 18/05/2026(UTC)Updated: 19/06/2026(UTC)Translated: 20/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The set_add method did not check values for newlines, colons, or pipes, allowing additional metrics to be injected from untrusted sources.

Risk Assessment

Organizations may be exposed to data manipulation, leading to incorrect analyses and decisions based on false information.

Recommendation

It is recommended to upgrade to version 0.10.1 or later to mitigate the risk of metric injection.

Other vulnerabilities in Net::Statsd::Lite

CVE-2026-46719Medium
Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections. Metric names were not checked for newlines, colons, or pipes, allowing additional metrics to be injected from untrusted sources.

Original NVD description (English source)

Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.