CVE Intelligence
Analysis AI-assisted

CVE-2026-50638: Metrics::Any::Adapter::DogStatsd for Perl - metric injection before 0.04

CVE-2026-50638 affects Metrics::Any::Adapter::DogStatsd for Perl in versions before 0.04, which does not protect against metric injection. The record says the DogStatsd protocol accepts newline-separated metrics in one packet, and that the _tags function does not filter newlines or StatsD control characters. The CNA and CISA-ADP both score it 9.1 (critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Metrics::Any::Adapter::DogStatsd for Perl, in versions before 0.04, does not protect against metric injection. The record states that the statsd protocol and extensions such as dogstatsd allow several metrics, separated by newlines, in one packet. The DogStatsd adapter extends the Statsd adapter, which has a similar weakness, and its _tags function does not check tags for newlines or statsd control characters.

Impact

  • Input that reaches metric names or tags may be interpreted as additional metrics, which is the injection condition described in the record.
  • Corrupted or spoofed metric data may mislead dashboards and alerts (inference, not stated in the sources).
  • The registered CVSS score is 9.1 (critical), with high confidentiality and integrity impact and no availability impact according to the scoring provided by the CNA and CISA-ADP.
  • The CWE assigned in the record is CWE-93.

Affected products and versions

  • Product listed in the record: Metrics::Any::Adapter::DogStatsd (Pevans), affected before 0.04.
  • The record also states that the Statsd adapter, which DogStatsd extends, has a similar vulnerability. Its affected range is not given in this record.
  • The fixed version is not listed in the fixes field. The affected range ends at 0.04, so 0.04 is the likely first fixed version (inference).

Exploitation status

  • This CVE is not listed in CISA KEV in the record.
  • No confirmed exploitation appears in the sources consulted.
  • SSVC lists exploitation as none and automatable as no.
  • The EPSS probability is 0.00554 with a percentile of 0.45522, as recorded.

Remediation and mitigation

  • Upgrade the DogStatsd adapter to 0.04 or later, the first version outside the affected range.
  • Review whether the Statsd adapter and other Metrics::Any adapters in your environment need the same update, since the record links this issue to the Statsd adapter.
  • Until patching is possible, validate and strip newlines and StatsD control characters from tags and metric names in application code.
  • Limit which components or users can influence metric names and tags.

Detection guidance

  • Look for metric series with unexpected names or values that appear shortly after changes to user-controlled tags.
  • Review ingestion logs for packets containing multiple metric lines where a single metric is expected.
  • Check dashboards and alerts for anomalies that could indicate injected or spoofed metrics.

Limitations of the available information

  • The record gives no fixed version, only the affected range before 0.04.
  • The release notes link points to the Metrics-Any-Adapter-Statsd 0.04 distribution, not explicitly to a DogStatsd fix, so the exact content of the fix is unconfirmed.
  • The CWE name is not provided in the record.
  • Related records CVE-2026-9270, CVE-2026-50637 and CVE-2026-50639 are tagged as related, but their content is not included here.
  • The EPSS date in the record is later than the publication date, so the EPSS values should be treated with caution.

Frequently asked questions

Which versions are affected by CVE-2026-50638?

The record lists Metrics::Any::Adapter::DogStatsd for Perl in versions before 0.04 as affected.

Is this vulnerability being exploited in the wild?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should I do if I use this adapter?

Upgrade to version 0.04 or later, check related adapters such as Statsd, and validate tags and metric names until the update is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.