CVE-2026-50639 Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections

Medium 6.5 Published 10 Jun 2026 Updated 19 Jun 2026

Attackers can inject arbitrary metrics or tags into SignalFx monitoring data via newline characters in Perl applications using this library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-50639?

CVE-2026-50639 is a medium-severity vulnerability in PEVANS Metrics::Any::Adapter::SignalFx, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections.

The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet.

Metrics::Any::Adapter::SignalFx which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability.

In addition, the _labels function does not check tags labels newlines or statsd control characters. The labels can be used for metric injections.

Weakness: CWE-93, CWE-150

Which versions are affected by CVE-2026-50639?

It affects 1 product.

Products include Pevans Metrics\.

How do I fix CVE-2026-50639?

No fix has been published for CVE-2026-50639 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-50639 being exploited?

There is no known exploitation of CVE-2026-50639 in the wild and no public exploit code.

Sources

Also known as GHSA-xr5m-f4c4-pqjm.