## SummaryCVE-2026-11362 affects DataDog::DogStatsd versions through 0.07 for Perl. It allows metric injection from event tags originating in untrusted sources, due to insufficient input sanitization.
## Technical Details
The issue is in format_event (used by the event method). It does not validate or properly sanitize tag content before incorporating it into the emitted metrics.
The NVD description highlights multiple injection-enabling characters in tags:
- Commas (,), which can allow tags to be injected by breaking the expected tag formatting.
- Newlines, pipes (|), and colons (:), which can alter how the metric line is interpreted.
Additionally, an attempted sanitization step is ineffective:
- There is an ineffective s/|//g intended to remove pipes, but because the pipe is not escaped, it is treated as a regular expression metacharacter and does not perform the intended removal.
## Affected
- DataDog::DogStatsd (Perl) versions <= 0.07
## Impact
With network access and no privileges required, an attacker can inject metrics by controlling event tags from untrusted sources. The CVSS vector indicates:
- Confidentiality impact: High (C:H)
- Integrity impact: High (I:H)
- Availability impact: High (A:H)
## Mitigation
1. Patch immediately by upgrading DataDog::DogStatsd to a version that is not affected (the NVD states the vulnerable range is <= 0.07).
2. If upgrading is not immediately possible, avoid passing untrusted data into event tags used by the event method, and ensure tag values are strictly validated/escaped to prevent injection characters (e.g., commas, newlines, pipes, colons).
3. Add monitoring for unexpected metric/tag patterns that could indicate injected metrics originating from event tag fields.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-93