EUVD-2026-34847
GHSA-37fh-f35c-r73m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags.
DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.
The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)
AnalysisAI
Metric and tag injection in the Perl DataDog::DogStatsd client (versions through 0.07) allows attackers who control event tag content to inject arbitrary metrics, tags, and event data into the DogStatsd telemetry stream. The CVSS 9.8 score reflects an unauthenticated network-vector CWE-93 (CRLF/separator injection) flaw where the format_event method fails to sanitize commas, newlines, pipes, and colons - including an ineffective s/|//g regex that misinterprets the pipe as a regex metacharacter. No public exploit identified at time of analysis and EPSS sits at 0.03% (8th percentile), indicating low observed exploitation interest despite the high CVSS rating.
Technical ContextAI
DataDog::DogStatsd is a Perl client library (CPE cpe:2.3:a:binary:datadog::dogstatsd) that serializes metrics and events into the StatsD/DogStatsD wire format, which uses pipes (|), colons (:), commas (,) and newlines as field and record separators. The root cause is CWE-93 (Improper Neutralization of CRLF Sequences / separator injection): the format_event method passes user-controlled tag content directly into the wire format. The included sanitization attempt - s/|//g - is broken because the pipe character is a regex alternation metacharacter and must be escaped (s/\|//g) to be treated literally, so the substitution is a no-op. As a result, any of the protocol's structural separators embedded in a tag are interpreted by the DogStatsD agent as legitimate protocol framing, enabling injection of additional tags, metrics, or whole events.
RemediationAI
No vendor-released patch identified at time of analysis - neither the CVE record nor the EUVD entry references a fixed version above 0.07, and the oss-security thread at https://seclists.org/oss-sec/2026/q2/827 should be monitored alongside CPAN for an updated release. In the interim, applications using DataDog::DogStatsd should sanitize tag values before calling the event method by stripping or rejecting commas, colons, pipes, and CR/LF characters from any tag content derived from untrusted sources; a local wrapper that applies tr/,:|\r\n//d (or equivalent) before submission is a low-risk compensating control whose only side effect is loss of those characters in legitimate tag values. Where feasible, restrict the DogStatsd UDP endpoint to localhost or a trusted socket so injected payloads cannot propagate to a shared aggregation pipeline, accepting the trade-off that this does not stop injection within the local monitoring scope. Consult the EUVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-11362 for the latest fix status.
Metric injection in the Perl DataDog::DogStatsd client (versions through 0.07) allows remote attackers to forge or manip
A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to
The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. Rated low severi
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today