CVE-2026-11362

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cve.org/CVERecord?id=CVE-2026-46719	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-46720	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-46741	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:binary:datadog\:\:dogstatsd:*:*:*:*:*:perl:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de DataDog::DogStatsd hasta la 0.07 para Perl permiten inyecciones de métricas desde etiquetas de eventos. DataDog::DogStatsd no sanea correctamente la entrada, permitiendo inyecciones de métricas de datos desde fuentes no confiables. El método format_event (utilizado por el método event) no valida el contenido de las etiquetas, que pueden contener comas (permitiendo la inyección de etiquetas) o saltos de línea, barras verticales y dos puntos que permiten inyecciones de métricas. (Existe un s/\|//g ineficaz para eliminar barras verticales, pero debido a que la barra vertical no está escapada, se interpreta como un metacaracter de expresión regular y no tiene efecto.)

Information

Published : 2026-06-05 16:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-11362

Mitre link : CVE-2026-11362

CVE.ORG link : CVE-2026-11362

JSON object : View

Products Affected

binary

datadog\

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

{"id": "CVE-2026-11362", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11362", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-08T18:20:03.616117Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/binary-com/dogstatsd-perl", "vendor": "BINARY", "product": "DataDog::DogStatsd", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.07"}], "packageName": "DataDog-DogStatsd", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "DataDog::DogStatsd::format_event"}, {"name": "DataDog::DogStatsd::event"}]}]}], "published": "2026-06-05T16:16:41.277", "references": [{"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46720", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46741", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-150"}]}], "descriptions": [{"lang": "en", "value": "DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags.\n\nDataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.\n\nThe format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)"}, {"lang": "es", "value": "Las versiones de DataDog::DogStatsd hasta la 0.07 para Perl permiten inyecciones de m\u00e9tricas desde etiquetas de eventos.\n\nDataDog::DogStatsd no sanea correctamente la entrada, permitiendo inyecciones de m\u00e9tricas de datos desde fuentes no confiables.\n\nEl m\u00e9todo format_event (utilizado por el m\u00e9todo event) no valida el contenido de las etiquetas, que pueden contener comas (permitiendo la inyecci\u00f3n de etiquetas) o saltos de l\u00ednea, barras verticales y dos puntos que permiten inyecciones de m\u00e9tricas. (Existe un s/|//g ineficaz para eliminar barras verticales, pero debido a que la barra vertical no est\u00e1 escapada, se interpreta como un metacaracter de expresi\u00f3n regular y no tiene efecto.)"}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:binary:datadog\\:\\:dogstatsd:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "7698C317-26E6-4CC9-8811-62E53194508F", "versionEndIncluding": "0.07"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}