QSearchQSearch

CVE-2026-11362

9.8 CRITICAL

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags

Published: 2026-06-05 · Last updated: 2026-06-10

Severity and scoring

CVSS
9.8 CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-150, CWE-93

Affected products

VendorProduct
binarydatadog\

Description

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-9270 — DataDog::DogStatsd versions through 0.07 for Perl allow metric injections (9.1 CRITICAL)

Same CWE

  • CVE-2026-50639 — Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections (6.5 MEDIUM)
  • CVE-2026-50638 — Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections
  • CVE-2026-50637 — Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections
  • CVE-2026-49756 — Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via att...
  • CVE-2026-9270 — DataDog::DogStatsd versions through 0.07 for Perl allow metric injections (9.1 CRITICAL)