CVE-2026-11362 Details
Description
DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)
A vulnerability exists in DataDog::DogStatsd for Perl, specifically in versions through 0.07, allowing metric injections from event tags. The issue arises because the format_event method, utilized by the event method, fails to properly sanitize input by validating the content of tags. This oversight permits the injection of metrics through untrusted data sources, as tags can include commas, newlines, pipes, and colons. Although there is an ineffective attempt to remove pipes, it fails due to the pipe not being escaped, rendering the removal ineffective.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cve.org/CVERecord?id=CVE-2026-46719 | CPANSec | Third Party Advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-46720 | CPANSec | Third Party Advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-46741 | CPANSec | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | CPANSec |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| binary datadog::dogstatsd | <= 0.07 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | Initial Analysis | [email protected] |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | New CVE Received | CPANSec |