CVE-2026-11362

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cve.org/CVERecord?id=CVE-2026-46719	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-46720	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-46741	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:binary:datadog\:\:dogstatsd:*:*:*:*:*:perl:*:*

History

10 Jun 2026, 15:01

Type	Values Removed	Values Added
References	~~() https://www.cve.org/CVERecord?id=CVE-2026-46719 -~~	() https://www.cve.org/CVERecord?id=CVE-2026-46719 - Third Party Advisory
References	~~() https://www.cve.org/CVERecord?id=CVE-2026-46720 -~~	() https://www.cve.org/CVERecord?id=CVE-2026-46720 - Third Party Advisory
References	~~() https://www.cve.org/CVERecord?id=CVE-2026-46741 -~~	() https://www.cve.org/CVERecord?id=CVE-2026-46741 - Third Party Advisory
First Time		Binary Binary datadog\
CPE		cpe:2.3:a:binary:datadog\:\:dogstatsd::::::perl::*

08 Jun 2026, 19:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8

05 Jun 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-05 16:16

Updated : 2026-06-17 10:13

NVD link : CVE-2026-11362

Mitre link : CVE-2026-11362

CVE.ORG link : CVE-2026-11362

JSON object : View

Products Affected

binary

datadog\

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

{"id": "CVE-2026-11362", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11362", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-08T18:20:03.616117Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/binary-com/dogstatsd-perl", "vendor": "BINARY", "product": "DataDog::DogStatsd", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.07"}], "packageName": "DataDog-DogStatsd", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "DataDog::DogStatsd::format_event"}, {"name": "DataDog::DogStatsd::event"}]}]}], "published": "2026-06-05T16:16:41.277", "references": [{"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46720", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46741", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-150"}]}], "descriptions": [{"lang": "en", "value": "DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags.\n\nDataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.\n\nThe format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)"}], "lastModified": "2026-06-17T10:13:59.040", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:binary:datadog\\:\\:dogstatsd:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "7698C317-26E6-4CC9-8811-62E53194508F", "versionEndIncluding": "0.07"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}