CVE-2026-9270 Details
Description
DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix. The send_stats method does not validate the content of the value ($delta variable), allowing attackers to inject metrics, especially from methods that do not restrict the data type for the value, such as set, gauge, count and histogram. The send_stats method does not validate the content of the tags, which may contain newlines, pipes and colons that allow metric injections. Note that the SYNOPSIS shows an example of passing a website form "loginName" parameter as a tag, which is unsafe.
A vulnerability allowing metric injections has been identified in DataDog::DogStatsd versions through 0.07, as well as in Net::Statsd::Lite versions prior to 0.9.0, Net::Statsd::Tiny versions prior to 0.3.8, and Etsy::StatsD versions through 1.002002, all for Perl. These versions allow unvalidated metric names and values, including tags, to be injected, potentially altering metric data sent to StatsD. The issue arises because the send_stats method fails to properly sanitize input, particularly for metrics generated from untrusted sources.
Users can upgrade to DataDog::DogStatsd version 0.08 or later, Net::Statsd::Lite version 0.9.0 or later, Net::Statsd::Tiny version 0.3.8 or later, and Etsy::StatsD version 1.002003 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cve.org/CVERecord?id=CVE-2026-46719 | CPANSec | Third Party Advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-46720 | CPANSec | Third Party Advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-46741 | CPANSec | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | CPANSec |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| binary datadog::dogstatsd | <= 0.07 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | Initial Analysis | [email protected] |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | New CVE Received | CPANSec |