Vulnerability Description
DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Binary | Datadog\ | <= 0.07, \ |
Related Weaknesses (CWE)
References
- https://www.cve.org/CVERecord?id=CVE-2026-46719Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-46720Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-46741Third Party Advisory
FAQ
What is CVE-2026-11362?
CVE-2026-11362 is a vulnerability with a CVSS score of 9.8 (CRITICAL). DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sourc...
How severe is CVE-2026-11362?
CVE-2026-11362 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-11362?
Check the references section above for vendor advisories and patch information. Affected products include: Binary Datadog\.