CVE-2026-11362
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk14th percentile — higher than 14% of all known CVEs
Summary
DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. The format_event method does not validate the content of the tags, allowing data injection from untrusted sources.
Risk Assessment
Improper data sanitization may lead to the injection of malicious metrics, threatening data integrity and potentially allowing unauthorized access or manipulation.
Recommendation
It is recommended to upgrade to the latest version of DataDog::DogStatsd that improves tag validation and input data sanitization.
Original NVD description (English source)
DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)