DataDog::DogStatsd EUVD-2026-34846

Exploitation requires that the host Perl application call DataDog::DogStatsd's send_stats (directly or via the set/gauge/count/histogram wrappers) with attacker-influenced data in the $stat name, $delta value, or tags arguments - exactly the pattern shown in the module's own SYNOPSIS where a web form 'loginName' parameter is used as a tag. The attacker must be able to reach an input channel (HTTP form field, header, API parameter, log line) that the application forwards into one of those arguments without sanitisation. Limiting factors: applications that hard-code metric names and tags, or that allow-list characters before calling the library, are not exploitable; the StatsD UDP endpoint receiving the metrics must also be the application's intended monitoring backend (typically the local Datadog Agent), so impact is confined to corrupting the victim organisation's own observability data rather than affecting third parties. CVSS PR:N/UI:N is accurate only for the network path into the vulnerable application's input - no authentication to the StatsD daemon itself is needed because the Perl process speaks to it directly.

Signals here are sharply divergent and require careful interpretation. The CVSS 9.1 with AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N is high because the scoring assumes confidentiality and integrity impact on the monitoring data stream, but real-world impact is bounded - this corrupts metrics/observability, not application data or code execution. EPSS of 0.03% (8th percentile) and absence from CISA KEV reflect that monitoring-corruption bugs in language-specific client libraries rarely attract opportunistic exploitation. No public exploit identified at time of analysis. The true risk hinges on whether the host application passes untrusted input (form fields, headers, usernames) directly into metric names or tags - the SYNOPSIS example shows exactly this anti-pattern, so vulnerable deployments are plausible. Treat as a medium-priority hygiene fix for any Perl service using this library with user-influenced metric labels; the headline 9.1 likely overstates urgency for most deployments.

A Perl web application uses DataDog::DogStatsd to record a login attempt and, following the module's SYNOPSIS example, passes the submitted loginName as a tag. An attacker submits a loginName like 'admin\nattacker.metric:9999|c|#env:prod' which, when serialised by send_stats, breaks the StatsD line and injects an arbitrary 'attacker.metric' counter into Datadog, poisoning dashboards, triggering false alerts, or masking real anomalies. No public exploit identified at time of analysis, but the technique is mechanical and follows directly from the disclosed protocol-injection primitive.