CVE-2026-50638 Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections

Critical 9.1 Published 10 Jun 2026 Updated 19 Jun 2026

Attackers can inject arbitrary metrics or tags into DogStatsd reports via newline characters, potentially corrupting monitoring data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-50638?

CVE-2026-50638 is a critical vulnerability in PEVANS Metrics::Any::Adapter::DogStatsd, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections.

The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet.

Metrics::Any::Adapter::DogStatsd which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability.

In addition, the _tags function does not check tags for newlines or statsd control characters. The tags can be used for metric injections.

Weakness: CWE-93, CWE-150

Which versions are affected by CVE-2026-50638?

It affects 1 product.

Products include Pevans Metrics\.

How do I fix CVE-2026-50638?

No fix has been published for CVE-2026-50638 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-50638 being exploited?

There is no known exploitation of CVE-2026-50638 in the wild and no public exploit code.

Sources

Also known as GHSA-m93c-ch8c-q8cj.