CVE-2026-50639 Details
Description
Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapter::SignalFx which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability. In addition, the _labels function does not check tags labels newlines or statsd control characters. The labels can be used for metric injections.
A vulnerability in Metrics::Any::Adapter::SignalFx for Perl, in versions prior to 0.04, allows for metric injections. This issue arises because the adapter, which extends Metrics::Any::Adapter::Statsd, does not properly validate metric names or values before they are sent. The statsd protocol permits multiple metrics to be included in a single packet, separated by newlines. If metric names contain newlines or certain control characters, such as colons or pipes, it becomes possible to inject metrics maliciously. Additionally, the _labels function fails to sanitize tag labels, leaving another avenue for metric injection.
Users can upgrade to Metrics::Any::Adapter::SignalFx version 0.04 or later, which addresses this vulnerability by implementing proper validation of metric names and values. The updated version is available on MetaCPAN.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/PEVANS/Metrics-Any-Adapter-Statsd-0.04/changes | CPANSec | Release Notes |
| https://www.cve.org/CVERecord?id=CVE-2026-50637 | CPANSec | Third Party Advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-50638 | CPANSec | Third Party Advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-9270 | CPANSec | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | CPANSec |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| pevans metrics::any::adapter::signalfx | < 0.04 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | Initial Analysis | [email protected] |
| Jun 19, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | CPANSec |