CVE-2026-11362 DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags
Attackers can inject arbitrary metrics or tags into DataDog monitoring via unsanitized input in the Perl DogStatsd library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11362?
CVE-2026-11362 is a critical vulnerability in BINARY DataDog::DogStatsd, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags.
DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.
The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)
Which versions are affected by CVE-2026-11362?
It affects 1 product.
Products include Binary Datadog\.
How do I fix CVE-2026-11362?
No fix has been published for CVE-2026-11362 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-11362 being exploited?
There is no known exploitation of CVE-2026-11362 in the wild and no public exploit code.
Other vulnerabilities in BINARY DataDog::DogStatsd
Sources
Also known as GHSA-37fh-f35c-r73m.