CVE-2026-11373 describes a vulnerability in JASEI's Net::Statsite::Client Perl module (versions <=1.1.0) where improper neutralization of CRLF sequences (CWE-93) and insufficient sanitization of protocol control characters (CWE-150) allow metric injection attacks. Specifically, newlines are not removed from metric names, and values are not sanitized for newlines or other control characters like colons or pipes. This flaw enables an attacker to inject crafted metrics into the statsite protocol, potentially manipulating monitoring data or causing unexpected behavior in systems relying on these metrics.

The vulnerability allows injection of arbitrary metrics into the statsite protocol by exploiting unsanitized newlines and control characters in metric names and values. This can lead to manipulation or corruption of monitoring data. There is no indication of remote code execution or direct system compromise from the provided data. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, users should consider sanitizing metric names and values themselves to remove newlines and control characters before sending data through Net::Statsite::Client.