What is the CVSS score of CVE-2026-9270?

CVE-2026-9270 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of DataDog::DogStatsd are affected by CVE-2026-9270?

The Perl DataDog StatsD client library (versions through 0.07) contains a metric injection vulnerability (CVSS 9.1) with no public exploit identified at time of analysis, but enables unauthenticated…

How to fix or mitigate CVE-2026-9270?

Within 24 hours: Inventory all systems using DataDog::DogStatsd 0.07 or earlier; identify applications passing untrusted input (web forms, APIs, user data) to metric names, values, or tags. Within 7 days: Deploy input validation and sanitization for all metric data, blocking newlines, pipes, and colons before library calls; restrict network access to StatsD endpoints via firewall rules. Within 30 days: Establish vendor communication timeline for patch; evaluate alternative metrics libraries or evaluate upgrading if patched versions become available; document all compensating controls and validate across production environment.

DataDog::DogStatsd CVE-2026-9270

EUVD-2026-34846 CRITICAL

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-06-05 CPANSec

GHSA-x9rg-6x4w-mpcx

Code Injection Datadog

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 19:22 vuln.today

CVSS changed

Jun 08, 2026 - 19:22 NVD

9.1 (CRITICAL)

CVE Published

Jun 05, 2026 - 14:49 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections.

DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.

The send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix.

The send_stats method does not validate the content of the value ($delta variable), allowing attackers to inject metrics, especially from methods that do not restrict the data type for the value, such as set, gauge, count and histogram.

The send_stats method does not validate the content of the tags, which may contain newlines, pipes and colons that allow metric injections.

Note that the SYNOPSIS shows an example of passing a website form "loginName" parameter as a tag, which is unsafe.

AnalysisAI

Metric injection in the Perl DataDog::DogStatsd client (versions through 0.07) allows remote attackers to forge or manipulate StatsD metrics by supplying unsanitised input containing newlines, pipes, or colons in stat names, values, or tags. With a CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) rating and CWE-93 (CRLF Injection) classification, attackers can corrupt monitoring data, change metric name prefixes, or inject arbitrary metrics - the SYNOPSIS example of passing a web form 'loginName' parameter as a tag is explicitly called out as unsafe. EPSS is very low (0.03%) and no public exploit identified at time of analysis, but the trivial network attack profile means risk depends entirely on whether untrusted input reaches the library.

Technical ContextAI

DataDog::DogStatsd is the Perl client library for sending StatsD/DogStatsD metrics to a Datadog Agent over UDP. The StatsD wire protocol is line-oriented and uses pipes (|) and colons (:) as field delimiters and newlines (\n) as record separators, so any unsanitised user data placed into the $stat name, $delta value, or tags array of send_stats can break out of the intended metric and inject additional metrics. This is a textbook CWE-93 (Improper Neutralization of CRLF Sequences) issue: the library trusts callers to pre-sanitise, but the documented SYNOPSIS encourages an unsafe pattern. The affected CPE is cpe:2.3:a:binary:datadog::dogstatsd:*:*:*:*:*:*:*:* covering all releases up to and including 0.07.

RemediationAI

No vendor-released patch version is identified in the provided data - the input states the issue affects versions through 0.07 but does not name a fixed release, so monitor CPAN and the Datadog repository for an updated DataDog::DogStatsd module above 0.07 and upgrade once available (https://nvd.nist.gov/vuln/detail/CVE-2026-9270 and https://seclists.org/oss-sec/2026/q2/826 are the authoritative tracking advisories). As compensating controls until a patched release ships, sanitise all caller-supplied data before passing it to send_stats: strip or reject newline (\n, \r), pipe (|), and colon (:) characters from the $stat name, the $delta value, and every tag string; in particular, never pass raw web form parameters (such as the 'loginName' shown in the module SYNOPSIS) as tags or stat names. Trade-offs: input sanitisation may drop legitimate characters from high-cardinality tags such as URLs and free-text fields, so prefer an allow-list of metric name characters ([A-Za-z0-9_.]) and constrain tags to known enumerations rather than user input. As a defense-in-depth control, network-restrict the StatsD UDP endpoint to localhost so injected metrics cannot be amplified across hosts.