Executive brief
A vulnerability in the Perl library for DataDog's DogStatsd service allows attackers to inject unauthorized data into monitoring streams. This library is used by applications to send performance metrics and events to DataDog for analysis. By exploiting this flaw, an attacker could manipulate monitoring dashboards, trigger false alerts, or corrupt operational data by including malicious characters in event tags.
Technical details
The DataDog::DogStatsd Perl library fails to properly sanitize input in the format_event method, which is utilized by the event method. Specifically, the library does not validate the content of tags, allowing them to contain commas, newlines, pipes, and colons. These characters can be used to inject additional tags or entirely new metrics into the DogStatsd stream. A failed attempt at mitigation exists in the code (s/|//g), but it is ineffective because the pipe character is not escaped, causing it to be treated as a regex metacharacter rather than a literal character to be removed. This is classified as a CRLF and control sequence injection vulnerability (CWE-93, CWE-150).
Affected products
- DataDog (Perl) DogStatsd through 0.07
Timeline
- 2026-06-05: disclosed
- 2026-06-05: advisory