CVE-2026-50638: Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections

Synopsis

This is a metric injection vulnerability in the Perl module Metrics::Any::Adapter::DogStatsd, affecting all versions before 0.04. The flaw is reachable over the network without any authentication and without requiring any victim interaction, because unsanitized newlines and statsd control characters in metric names and tags are forwarded directly into DogStatsd protocol packets. A successful attacker can forge arbitrary metrics or tamper with metric data sent to the monitoring backend, corrupting observability data and causing persistent misrepresentation of application telemetry. A patched-image rebuild at version 0.04 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable module accepts metric input over the network, so an attacker must be able to send data to the exposed DogStatsd ingestion path.

• AuthenticationNot required

  No credentials or session token of any kind are required to supply crafted metric names or tags.

• Victim interactionNot required

  Exploitation is fully passive from the victim side; no user action or click is needed to trigger the injection.

• Attack complexityDetail

  The exploit is reliable and condition-free: the attacker simply embeds newlines or statsd control characters in metric names or tag values, with no race condition or special environmental setup required.

Blast Radius

• An attacker forges arbitrary metric names and values in the DogStatsd stream, injecting synthetic telemetry into the monitoring backend.
• Tag fields can be poisoned with control characters, corrupting dashboards, alerts, and automated anomaly-detection rules that depend on tag integrity.
• Legitimate metrics can be shadowed or overwritten, causing on-call teams to act on false observability data during incidents.