CVE-2026-9270

The send_stats method does not remove newline characters from metric names (variable $stat), which allows an attacker to alter the metric name prefix. This method also does not validate the content of values (variable $delta), making it possible to inject arbitrary metrics — especially through methods such as set, gauge, count, and histogram, which do not restrict the data type for this value. Additionally, tags passed to send_stats are not validated for the presence of newline characters, pipe characters (|), and colons, which enable metric injection attacks. The library documentation (SYNOPSIS section) shows as an example passing the form parameter 'loginName' directly as a tag, which constitutes a vulnerable usage pattern.

An attacker can inject arbitrary metrics into the monitoring system, manipulating data collected by DataDog, which may lead to falsification of application statistics and violation of monitoring data integrity (CWE-93, CWE-150). High level of impact on confidentiality and integrity indicates risk of impersonating other metrics and potential disclosure of sensitive data through manipulated metric names or tags.

Patches available from the vendor should be applied according to references. Additionally, untrusted input data (such as HTTP form parameters) should no longer be passed directly as metric names, values, or tags to the DogStatsd library without prior validation and sanitization.

DataDog::DogStatsd for Perl in versions up to and including 0.07