CVE-2026-9270: DataDog::DogStatsd versions through 0.07 for Perl allow metric injections

Synopsis

Metric injection vulnerability in the Perl DataDog::DogStatsd library (versions through 0.07) allows a remote, unauthenticated attacker to send unsanitized input through the send_stats method. By embedding newlines, pipe characters, or colons in metric names, values, or tags, an attacker can forge or overwrite StatsD metric data. Successful exploitation gives the attacker the ability to corrupt telemetry records and read or tamper with metric streams, but does not directly crash the service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable library is exposed over the network; an attacker must be able to reach the service endpoint that passes untrusted input to send_stats.

• AuthenticationNot required

  No credentials are needed; any unauthenticated request that reaches the affected input path is sufficient to inject metric data.

• Victim interactionNot required

  No user action is required; the attacker interacts directly with the service without involving any human victim.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; inserting newline or pipe characters into metric names, values, or tags requires no special timing, memory knowledge, or environmental setup.

Blast Radius

• Attacker injects fabricated metric events, overwriting or forging telemetry records stored in the downstream metrics backend.
• Attacker reads or infers the metric name prefix and tag structure, exposing internal naming conventions and application instrumentation details.
• Attacker manipulates gauge, count, histogram, and set values reported to Datadog, corrupting dashboards, alerts, and SLO calculations that depend on that data.