EUVD-2026-34847
GHSA-37fh-f35c-r73m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags.
DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.
The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)
AnalysisAI
Metric and tag injection in the Perl DataDog::DogStatsd client (versions through 0.07) allows attackers who control event tag content to inject arbitrary metrics, tags, and event data into the DogStatsd telemetry stream. The CVSS 9.8 score reflects an unauthenticated network-vector CWE-93 (CRLF/separator injection) flaw where the format_event method fails to sanitize commas, newlines, pipes, and colons - including an ineffective s/|//g regex that misinterprets the pipe as a regex metacharacter. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the consuming Perl application calls DataDog::DogStatsd's event method (which invokes format_event) with tag values derived from attacker-controlled input - the vulnerability lives in the library but cannot be triggered without an application that passes untrusted data into tags. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here conflict sharply and warrant careful interpretation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A web application using DataDog::DogStatsd records an event tag containing a user-supplied value such as a username or search term; an attacker submits a value containing pipes, commas, or newlines that, when serialized by format_event, are interpreted by the receiving DogStatsd agent as additional protocol framing. The result is forged metrics, fake events, or poisoned tags appearing in the victim's DataDog dashboards, potentially masking real alerts, triggering false ones, or polluting billing dimensions. … |
| Remediation | No vendor-released patch identified at time of analysis - neither the CVE record nor the EUVD entry references a fixed version above 0.07, and the oss-security thread at https://seclists.org/oss-sec/2026/q2/827 should be monitored alongside CPAN for an updated release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today