CVE-2026-11373 JASEI CVE debrief

Who should care

Users of Net::Statsite::Client version 1.1.0 or earlier for Perl should be concerned about this vulnerability. This includes developers and administrators who use this module to send metrics to statsite servers. The vulnerability could allow attackers to inject malicious metrics, potentially leading to unauthorized data or misleading information being sent to monitoring systems.

Technical summary

The Net::Statsite::Client module for Perl, up to version 1.1.0, does not properly sanitize metric names and values. Specifically, it does not remove newlines from metric names and does not sanitize values for newlines or protocol control characters such as colons or pipes. This lack of sanitization allows for metric injections, enabling an attacker to send arbitrary metrics to a statsite server. The vulnerability is classified under CWE-93 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-150 (Improper Neutralization of Special Elements used in a Command).

Defensive priority

Medium priority due to potential for data injection and misinformation in monitoring systems.

Recommended defensive actions

• Inventory and review systems using Net::Statsite::Client version 1.1.0 or earlier.
• Apply the official patch or upgrade to a version of Net::Statsite::Client that properly sanitizes metric names and values.
• Review and restrict access to systems and users that can submit metrics to statsite servers.
• Monitor for unusual or unauthorized metrics being sent from affected systems.
• Consider implementing compensating controls, such as validating metric data before submission.

Evidence notes

The primary evidence for this vulnerability comes from the CVE-2026-11373 record and references provided by NVD and CVE.org. The affected product is Net::Statsite::Client versions up to 1.1.0 for Perl. Evidence limits are based on information available up to June 22, 2026. Defenders should verify the official CVE record and vendor advisories for the most current information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.