CVE-2026-11362: DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags

Synopsis

This is a metric injection vulnerability in the DataDog::DogStatsd Perl library, versions 0.07 and earlier. The library is reachable over the network with no authentication required, because applications typically call it as part of handling untrusted input such as HTTP request data. Successful exploitation lets an attacker inject arbitrary StatsD metrics and events into a Datadog backend, tamper with monitoring data, and depending on backend parsing, trigger downstream integrity and confidentiality failures. No upstream fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is exposed over the network; an attacker can reach it by sending crafted input to any application endpoint that passes untrusted data through the DataDog::DogStatsd event or format_event methods.

• AuthenticationNot required

  No credentials or account are needed; the injection surface is available to any unauthenticated party who can reach the application.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any user or operator.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and requires no special conditions, race timing, or knowledge of memory layout.

Blast Radius

• An attacker injects fabricated metric names, values, and tags into the Datadog backend, corrupting dashboards, alerts, and SLO calculations that downstream teams rely on.
• Injected newline and pipe characters allow the attacker to write entirely synthetic StatsD protocol messages, potentially forging health-check events or silencing real alerting.
• Depending on how the Datadog backend and any connected automation (auto-scaling, incident response) consume metric data, tampered values can cause incorrect operational decisions at scale.
• Confidentiality impact is high per CVSS; a backend that echoes or logs injected payloads may expose internal metric naming conventions, service topology, or environment identifiers to the attacker.