Executive brief
A vulnerability in the Perl library used to send data to Datadog allows attackers to inject fake or malicious monitoring data. By providing specially crafted input, an attacker could manipulate system metrics, potentially hiding malicious activity or triggering false alerts in monitoring dashboards. This could lead to a loss of visibility into the actual health and security of the application.
Technical details
The DataDog::DogStatsd Perl library fails to properly sanitize input in its send_stats method, leading to CRLF and metric injection vulnerabilities. Specifically, the library does not remove newlines from metric names ($stat), fails to validate the content of values ($delta), and does not sanitize tags for special characters like newlines, pipes, or colons. An attacker who can influence these parameters—such as through a web form parameter used as a tag—can inject arbitrary metrics into the DogStatsD stream. This is classified under CWE-93 (CRLF Injection) and CWE-150.
Affected products
- DataDog DogStatsd (Perl) through 0.07
Timeline
- 2026-06-05: disclosed
- 2026-06-05: advisory