Executive brief
A vulnerability in a Perl library used for reporting application performance data allows attackers to inject fake metrics. This library is used to send monitoring data to DogStatsd and Statsd services. By including special characters in data fields, an attacker could corrupt monitoring dashboards or trigger false alerts, potentially masking real operational issues.
Technical details
The Metrics::Any::Adapter::DogStatsd library for Perl is vulnerable to CRLF injection (CWE-93) in its metric reporting functions. The Statsd and DogStatsd protocols use newlines to separate multiple metrics within a single network packet. The library's `_tags` function fails to validate or sanitize tags for newlines or other protocol control characters. An attacker who can influence the content of metric tags can inject arbitrary metric data into the stream. This issue was addressed in version 0.04.
Affected products
- Perl CPAN Metrics::Any::Adapter::DogStatsd < 0.04
Timeline
- 2026-06-06: patched: Version 0.04 released to address injection vulnerabilities.
- 2026-06-10: disclosed: CVE-2026-50638 published.