CVE-2026-9270

{
  "id": "CVE-2026-9270",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-06-05T16:16:41.780",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DataDog::DogStatsd versions through 0.07 for Perl allow metric injections.\n\nDataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.\n\nThe send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix.\n\nThe send_stats method does not validate the content of the value ($delta variable), allowing attackers to inject metrics, especially from methods that do not restrict the data type for the value, such as set, gauge, count and histogram.\n\nThe send_stats method does not validate the content of the tags, which may contain newlines, pipes and colons that allow metric injections.\n\nNote that the SYNOPSIS shows an example of passing a website form \"loginName\" parameter as a tag, which is unsafe."
    },
    {
      "lang": "es",
      "value": "Las versiones de DataDog::DogStatsd hasta la 0.07 para Perl permiten inyecciones de métricas.\n\nDataDog::DogStatsd no sanea adecuadamente la entrada, permitiendo inyecciones de métricas de datos de fuentes no confiables.\n\nEl método send_stats no elimina los saltos de línea de los nombres de las métricas (variable $stat), permitiendo a los atacantes cambiar el prefijo del nombre de la métrica.\n\nEl método send_stats no valida el contenido del valor (variable $delta), permitiendo a los atacantes inyectar métricas, especialmente desde métodos que no restringen el tipo de datos para el valor, como set, gauge, count e histogram.\n\nEl método send_stats no valida el contenido de las etiquetas, las cuales pueden contener saltos de línea, barras verticales y dos puntos que permiten inyecciones de métricas.\n\nTenga en cuenta que el SYNOPSIS muestra un ejemplo de pasar un parámetro ’loginName’ de un formulario de sitio web como una etiqueta, lo cual no es seguro."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "BINARY",
          "product": "DataDog::DogStatsd",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "DataDog-DogStatsd",
          "programRoutines": [
            {
              "name": "DataDog::DogStatsd::send_stats"
            },
            {
              "name": "DataDog::DogStatsd::set"
            },
            {
              "name": "DataDog::DogStatsd::gauge"
            },
            {
              "name": "DataDog::DogStatsd::count"
            },
            {
              "name": "DataDog::DogStatsd::histogram"
            }
          ],
          "repo": "https://github.com/binary-com/dogstatsd-perl",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "0.07",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-08T18:17:00.524236Z",
          "id": "CVE-2026-9270",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        },
        {
          "lang": "en",
          "value": "CWE-150"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:binary:datadog\\:\\:dogstatsd:*:*:*:*:*:perl:*:*",
              "versionEndIncluding": "0.07",
              "matchCriteriaId": "7698C317-26E6-4CC9-8811-62E53194508F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46719",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46720",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46741",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}