DataDog::DogStatsd EUVD-2026-34847

Exploitation requires that the consuming Perl application calls DataDog::DogStatsd's event method (which invokes format_event) with tag values derived from attacker-controlled input - the vulnerability lives in the library but cannot be triggered without an application that passes untrusted data into tags. Limiting factors: the attack target is the DogStatsd/DataDog telemetry pipeline rather than the host application, so impact is bounded by what the receiving DataDog agent and backend do with injected metrics; the StatsD protocol is typically carried over UDP to a local agent, so the AV:N rating in CVSS is optimistic unless the deployment exposes the StatsD endpoint over the network. There is no authentication requirement at the library layer because the flaw is purely a string-formatting issue, but practical exploitation depends entirely on a downstream application choosing to forward unsanitized user input into event tags.

The signals here conflict sharply and warrant careful interpretation. CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H suggests an unauthenticated network-exploitable, high-impact issue, but the EPSS score of 0.03% (8th percentile) and the absence of KEV listing or public exploit code indicate negligible real-world exploitation interest. The CVSS rating likely overstates real-world risk: this is a library-level injection where impact depends entirely on whether downstream applications feed untrusted user input into event tags, and the worst plausible outcome is metric/telemetry poisoning of a DataDog pipeline rather than direct code execution or data theft. The C:H/I:H/A:H impact ratings appear to assume the StatsD endpoint is a security boundary, which is not how StatsD is typically deployed (UDP, local agent). Prioritization should be guided by whether the consuming application accepts untrusted tag input - for most internal monitoring use cases this is a moderate hygiene fix, not an emergency.

A web application using DataDog::DogStatsd records an event tag containing a user-supplied value such as a username or search term; an attacker submits a value containing pipes, commas, or newlines that, when serialized by format_event, are interpreted by the receiving DogStatsd agent as additional protocol framing. The result is forged metrics, fake events, or poisoned tags appearing in the victim's DataDog dashboards, potentially masking real alerts, triggering false ones, or polluting billing dimensions. No public exploit identified at time of analysis, but the bug is trivial to trigger once an attacker identifies an input path that reaches an event tag.