{"id":"CVE-2026-8788","aliases":["EUVD-2026-30739","GHSA-57h4-p8xg-x38x"],"status":"published","title":"Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections","description":"Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00226,"percentile":0.13422,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-150","CWE-93"],"published":"2026-05-18T06:34:24Z","modified":"2026-10-28T02:30:48Z","products":[{"vendor":"rrwo","product":"net::statsd::lite"}],"references":[{"url":"https://metacpan.org/release/RRWO/Net-Statsd-Lite-v0.10.1/changes","tags":["release-notes","advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46719","tags":["related","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8788","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-57h4-p8xg-x38x"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8788.json","tags":["advisory"]},{"url":"https://github.com/robrwo/Net-Statsd-Lite","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-8788","title":"Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections","description":"Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.","status":"published","published":"2026-05-18T06:34:24.03Z","modified":"2026-06-19T15:34:16.945Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-93","CWE-150"],"updated_at":"2026-11-02T13:48:13.398044Z"}],"euvd":[{"id":"EUVD-2026-30739","description":"Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.","status":"published","published":"2026-05-18T06:34:24Z","modified":"2026-06-19T15:34:16Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T18:20:35.844489Z"}],"ghsa":[{"id":"GHSA-57h4-p8xg-x38x","title":"Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from...","description":"Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.","status":"published","published":"2026-05-18T09:31:48Z","modified":"2026-05-19T15:31:23Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:08:12.004262Z"}],"nvd":[{"id":"CVE-2026-8788","description":"Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.","status":"published","published":"2026-05-18T08:16:15.32Z","modified":"2026-10-26T13:10:00.14Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-93","CWE-150"],"updated_at":"2026-11-02T14:12:19.39893Z"}],"osv":[{"id":"CVE-2026-8788","title":"Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections","description":"Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.\n\nThe values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.\n\nNote that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.","status":"published","published":"2026-05-18T06:34:24.03Z","modified":"2026-10-28T02:30:48.230489627Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-150","CWE-93"],"updated_at":"2026-11-02T15:45:19.210277Z"}]}}