CVE-2026-9270

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9270", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-05-22T10:23:06.050Z", "datePublished": "2026-06-05T14:49:39.714Z", "dateUpdated": "2026-06-08T18:17:12.608Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "DataDog-DogStatsd", "product": "DataDog::DogStatsd", "programRoutines": [{"name": "DataDog::DogStatsd::send_stats"}, {"name": "DataDog::DogStatsd::set"}, {"name": "DataDog::DogStatsd::gauge"}, {"name": "DataDog::DogStatsd::count"}, {"name": "DataDog::DogStatsd::histogram"}], "repo": "https://github.com/binary-com/dogstatsd-perl", "vendor": "BINARY", "versions": [{"lessThanOrEqual": "0.07", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "DataDog::DogStatsd versions through 0.07 for Perl allow metric injections.\n\nDataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.\n\nThe send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix.\n\nThe send_stats method does not validate the content of the value ($delta variable), allowing attackers to inject metrics, especially from methods that do not restrict the data type for the value, such as set, gauge, count and histogram.\n\nThe send_stats method does not validate the content of the tags, which may contain newlines, pipes and colons that allow metric injections.\n\nNote that the SYNOPSIS shows an example of passing a website form \"loginName\" parameter as a tag, which is unsafe."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-150", "description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-05T14:49:39.714Z"}, "references": [{"url": "https://www.cve.org/CVERecord?id=CVE-2026-46741"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46720"}], "source": {"discovery": "UNKNOWN"}, "title": "DataDog::DogStatsd versions through 0.07 for Perl allow metric injections", "workarounds": [{"lang": "en", "value": "Ensure that metric names, values and tags come from trusted sources or are properly sanitised."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T18:17:00.524236Z", "id": "CVE-2026-9270", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T18:17:12.608Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-9270", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-08T18:17:00.524236Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T18:16:55.711Z"}}], "cna": {"title": "DataDog::DogStatsd versions through 0.07 for Perl allow metric injections", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/binary-com/dogstatsd-perl", "vendor": "BINARY", "product": "DataDog::DogStatsd", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.07"}], "packageName": "DataDog-DogStatsd", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "DataDog::DogStatsd::send_stats"}, {"name": "DataDog::DogStatsd::set"}, {"name": "DataDog::DogStatsd::gauge"}, {"name": "DataDog::DogStatsd::count"}, {"name": "DataDog::DogStatsd::histogram"}]}], "references": [{"url": "https://www.cve.org/CVERecord?id=CVE-2026-46741"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46719"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-46720"}], "workarounds": [{"lang": "en", "value": "Ensure that metric names, values and tags come from trusted sources or are properly sanitised."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "DataDog::DogStatsd versions through 0.07 for Perl allow metric injections.\n\nDataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.\n\nThe send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix.\n\nThe send_stats method does not validate the content of the value ($delta variable), allowing attackers to inject metrics, especially from methods that do not restrict the data type for the value, such as set, gauge, count and histogram.\n\nThe send_stats method does not validate the content of the tags, which may contain newlines, pipes and colons that allow metric injections.\n\nNote that the SYNOPSIS shows an example of passing a website form \"loginName\" parameter as a tag, which is unsafe."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93 Improper Neutralization of CRLF Sequences"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-150", "description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-06-05T14:49:39.714Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9270", "state": "PUBLISHED", "dateUpdated": "2026-06-08T18:17:12.608Z", "dateReserved": "2026-05-22T10:23:06.050Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-06-05T14:49:39.714Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "DataDog-DogStatsd", "product": "DataDog::DogStatsd", "programRoutines": [{"name": "DataDog::DogStatsd::send_stats"}, {"name": "DataDog::DogStatsd::set"}, {"name": "DataDog::DogStatsd::gauge"}, {"name": "DataDog::DogStatsd::count"}, {"name": "DataDog::DogStatsd::histogram"}], "repo": "https://github.com/binary-com/dogstatsd-perl", "vendor": "BINARY", "versions": [{"lessThanOrEqual": "0.07", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:binary:datadog\\:\\:dogstatsd:*:*:*:*:*:perl:*:*", "matchCriteriaId": "7698C317-26E6-4CC9-8811-62E53194508F", "versionEndIncluding": "0.07", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "DataDog::DogStatsd versions through 0.07 for Perl allow metric injections.\n\nDataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.\n\nThe send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix.\n\nThe send_stats method does not validate the content of the value ($delta variable), allowing attackers to inject metrics, especially from methods that do not restrict the data type for the value, such as set, gauge, count and histogram.\n\nThe send_stats method does not validate the content of the tags, which may contain newlines, pipes and colons that allow metric injections.\n\nNote that the SYNOPSIS shows an example of passing a website form \"loginName\" parameter as a tag, which is unsafe."}, {"lang": "es", "value": "Las versiones de DataDog::DogStatsd hasta la 0.07 para Perl permiten inyecciones de m\u00e9tricas.\n\nDataDog::DogStatsd no sanea adecuadamente la entrada, permitiendo inyecciones de m\u00e9tricas de datos de fuentes no confiables.\n\nEl m\u00e9todo send_stats no elimina los saltos de l\u00ednea de los nombres de las m\u00e9tricas (variable $stat), permitiendo a los atacantes cambiar el prefijo del nombre de la m\u00e9trica.\n\nEl m\u00e9todo send_stats no valida el contenido del valor (variable $delta), permitiendo a los atacantes inyectar m\u00e9tricas, especialmente desde m\u00e9todos que no restringen el tipo de datos para el valor, como set, gauge, count e histogram.\n\nEl m\u00e9todo send_stats no valida el contenido de las etiquetas, las cuales pueden contener saltos de l\u00ednea, barras verticales y dos puntos que permiten inyecciones de m\u00e9tricas.\n\nTenga en cuenta que el SYNOPSIS muestra un ejemplo de pasar un par\u00e1metro \u2019loginName\u2019 de un formulario de sitio web como una etiqueta, lo cual no es seguro."}], "id": "CVE-2026-9270", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9270", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-08T18:17:00.524236Z", "version": "2.0.3"}}]}, "published": "2026-06-05T16:16:41.780", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-46719"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-46720"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-46741"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-150"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.07]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DataDog::DogStatsd", "source": "cna", "vendor": "BINARY"}, "product": "datadog::dogstatsd", "vendor": "binary"}], "created": "2026-06-05T16:30:06.341096+00:00", "updated": "2026-06-08T20:45:32.492480+00:00", "vendors": ["binary", "binary$PRODUCT$datadog::dogstatsd"]}