CVE-2026-50637

Analyzed Analyzed - Analysis Complete

Metric Injection Vulnerability in Metrics::Any::Adapter::Statsd Perl Module

Publication date: 2026-06-10

Last updated on: 2026-06-24

Assigner: CPANSec

Description

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions) allow mutiple metrics, separated by newlines, to be sent per packet. The send method does not validate the contents of the metric names or values. If the names have newlines and statsd control characters (colon, pipe) then metric injections are possible. Version 0.04 fixed this by modifying the _make method to block metric names with characters below ASCII 32 (which includes the newline), or colons or pipes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-24

Generated

2026-07-01

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-30

NVD

CVE-2026-50637

EUVD

EUVD-2026-36104

Affected Vendors & Products

Vendor	Product	Version / Range
pevans	metrics	to 0.04 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CWE-150	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

Executive Summary

The vulnerability exists in Metrics::Any::Adapter::Statsd versions before 0.04 for Perl, where the software does not protect against metric injections.

The statsd protocol allows multiple metrics to be sent in a single packet, separated by newlines. However, the send method in these versions does not validate the contents of metric names or values.

If metric names contain newlines or statsd control characters such as colon or pipe, an attacker can inject additional metrics, leading to metric injection attacks.

Version 0.04 fixed this issue by modifying the _make method to block metric names containing characters below ASCII 32 (including newline), colons, or pipes.

Impact Analysis

This vulnerability can allow an attacker to inject unauthorized or malicious metrics into the monitoring system.

Such metric injections can lead to inaccurate monitoring data, potentially causing incorrect alerts, misinterpretation of system health, or masking of real issues.

In environments relying on metrics for automated responses or billing, this could result in operational disruptions or financial inaccuracies.

Mitigation Strategies

To mitigate this vulnerability, upgrade Metrics::Any::Adapter::Statsd to version 0.04 or later.

Version 0.04 fixed the issue by modifying the _make method to block metric names containing characters below ASCII 32 (including newline), colons, or pipes, which prevents metric injections.

Hi! I’m here to help you understand CVE-2026-50637. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70