What is the CVSS score of EUVD-2026-36105?

EUVD-2026-36105 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Metrics::Any::Adapter::DogStatsd are affected by EUVD-2026-36105?

Metrics::Any::Adapter::DogStatsd versions before 0.04 contain a metric injection vulnerability (CVSS 9.1) allowing attackers to forge monitoring metrics by injecting newline characters through…. A patch is available.

How to fix or mitigate EUVD-2026-36105?

Within 24 hours: Audit infrastructure for Metrics::Any::Adapter::DogStatsd using CPAN package inventories and dependency scanners. Within 7 days: Plan and execute upgrade to Metrics::Any::Adapter::DogStatsd 0.04 or later in pre-production, validating monitoring pipeline functionality. Within 30 days: Deploy patched version to all production systems.

Metrics::Any::Adapter::DogStatsd EUVD-2026-36105

| CVE-2026-50638 CRITICAL

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-06-10 CPANSec

GHSA-m93c-ch8c-q8cj

Code Injection Metrics

9.1

CVSS 3.1 · Vendor: CPANSec

Severity by source

Vendor (CPANSec) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable via injected strings with no auth or UI (AV:N/AC:L/PR:N/UI:N); impact is limited integrity corruption of telemetry data, with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 11, 2026 - 20:24 vuln.today

CVSS changed

Jun 11, 2026 - 20:22 NVD

9.1 (CRITICAL)

Patch available

Jun 10, 2026 - 21:16 EUVD

CVE Published

Jun 10, 2026 - 18:32 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections.

The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics,separated by newlines, to be sent per packet.

Metrics::Any::Adapter::DogStatsd which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability.

In addition, the _tags function does not check tags for newlines or statsd control characters. The tags can be used for metric injections.

AnalysisAI

Metric injection in the Perl module Metrics::Any::Adapter::DogStatsd before 0.04 allows remote attackers to inject arbitrary StatsD/DogStatsD metrics by smuggling newline characters through unsanitized metric names and tags. Because the StatsD protocol treats newlines as packet delimiters for multiple metrics, attacker-controlled values forwarded into the adapter can forge additional metrics or tag payloads on the wire, with no public exploit identified at time of analysis and an EPSS score of 0.03% indicating low near-term exploitation probability.

Technical ContextAI

The vulnerable component is the CPAN distribution Metrics::Any::Adapter::DogStatsd authored by PEVANS, which extends Metrics::Any::Adapter::Statsd to support Datadog's DogStatsD extensions (tag support beyond plain StatsD). The StatsD line-oriented UDP protocol allows multiple metrics in a single packet separated by '\n' newlines, and DogStatsD additionally permits per-metric tags appended after a '|#' separator. The root cause is CWE-93 (Improper Neutralization of CRLF Sequences, 'CRLF Injection'): neither the metric-emit path inherited from the Statsd parent adapter nor the internal _tags helper validates or escapes newline characters and StatsD control characters ('|', ':', '#', '@') in caller-supplied metric names or tag values, so any attacker-controlled string flowing into the adapter is concatenated directly into the wire payload. A sibling vulnerability in the parent Metrics::Any::Adapter::Statsd module is tracked alongside this issue (see related CVE-2026-50637 referenced in the advisory).

RemediationAI

Vendor-released patch: Metrics::Any::Adapter::DogStatsd 0.04 - upgrade via cpan/cpanm/Carton (e.g. 'cpanm Metrics::Any::Adapter::DogStatsd@0.04') and simultaneously update Metrics::Any::Adapter::Statsd to 0.04 to address the related parent-module issue (CVE-2026-50637), per the release notes at https://metacpan.org/release/PEVANS/Metrics-Any-Adapter-Statsd-0.04/changes and the oss-security advisory at https://seclists.org/oss-sec/2026/q2/879. Where immediate upgrade is not possible, apply caller-side compensating controls: strip or reject '\n', '\r', '|', ':', '#' and '@' in any user-controlled string before passing it as a metric name, value, or tag (side effect: legitimate values containing these characters will be mangled or rejected), and avoid using request-derived data such as URL paths, user-agent strings or form fields directly as metric/tag identifiers (side effect: reduces dashboard granularity but eliminates the injection sink). As a network-layer defense, restrict egress of the StatsD/DogStatsD UDP port (default 8125) to only the intended collector host so that injected packets cannot be redirected, and consider terminating telemetry at a local agent that re-serializes metrics from a structured form rather than forwarding raw text.