Executive brief
A vulnerability exists in a Perl library used for sending application performance data to SignalFx monitoring services. Because the library fails to properly clean the data it processes, an attacker could inject fake or malicious metrics into the monitoring stream. This could lead to inaccurate business dashboards, false alerts, or the masking of actual system issues.
Technical details
The Metrics::Any::Adapter::SignalFx library is vulnerable to metric injection due to improper neutralization of CRLF sequences and statsd control characters. The root cause is located in the _labels function, which fails to validate or sanitize tags, labels, and newlines before incorporating them into the statsd/dogstatsd protocol stream. Since the protocol allows multiple metrics to be separated by newlines within a single packet, an attacker who can influence label values can inject arbitrary metric data. This is a CRLF injection vulnerability (CWE-93) inherited from its base class, Metrics::Any::Adapter::Statsd. The issue is resolved in version 0.04.
Affected products
- Perl CPAN Metrics::Any::Adapter::SignalFx < 0.04
Timeline
- 2026-06-06: patched: Version 0.04 released to address injection vulnerabilities.
- 2026-06-10: disclosed: CVE-2026-50639 published.