{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8788", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-05-17T12:01:20.592Z", "datePublished": "2026-05-18T06:34:24.030Z", "dateUpdated": "2026-05-18T06:34:24.030Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-Statsd-Lite", "product": "Net::Statsd::Lite", "programRoutines": [{"name": "Net::Statsd::Lite::record_metric"}], "repo": "https://github.com/robrwo/Net-Statsd-Lite", "vendor": "RRWO", "versions": [{"lessThanOrEqual": "0.10.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-18T06:34:24.030Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.10.1/changes"}, {"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-46719"}], "solutions": [{"lang": "en", "value": "Upgrade to Net::Statsd::Lite version 0.10.1 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-05-14T00:00:00.000Z", "value": "Issue reported to CPANSec"}, {"lang": "en", "time": "2026-05-15T00:00:00.000Z", "value": "Author notified"}, {"lang": "en", "time": "2026-05-16T00:00:00.000Z", "value": "Fix released for CVE-2026-46719"}, {"lang": "en", "time": "2026-05-17T00:00:00.000Z", "value": "CVE-2026-8788 identified by author"}, {"lang": "en", "time": "2025-05-17T00:00:00.000Z", "value": "Fix released for CVE-2026-8788"}], "title": "Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections", "workarounds": [{"lang": "en", "value": "In version 0.10.0, use the secure_set_add method which logs an HMAC digest of the value instead of the raw value.\n\nValidate that all values sent to the client based on untrusted data do not contain metric injections."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names."}], "id": "CVE-2026-8788", "lastModified": "2026-05-18T08:16:15.320", "metrics": {}, "published": "2026-05-18T08:16:15.320", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.10.1/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46719"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{}