PUBLISHED
2026-06-05 16:16
MODIFIED
2026-06-05 16:16
EPSS (Prob. Exploit)
0.54%
Top 55.6%
> DESCRIPTION
DataDog::DogStatsd versions through 0.07 for Perl allow metric injections.
DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.
The send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix.
The send_stats method does not validate the content of the value ($delta variable), allowing attackers to inject metrics, especially from methods that do not restrict the data type for the value, such as set, gauge, count and histogram.
The send_stats method does not validate the content of the tags, which may contain newlines, pipes and colons that allow metric injections.
Note that the SYNOPSIS shows an example of passing a website form "loginName" parameter as a tag, which is unsafe.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-93: Improper Neutralization of CRLF Sequences - The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. | CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences - The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
> GITHUB SECURITY ADVISORY
GHSA-qhrr-8q5h-9q3h
MODERATE
MessagePack: Nested arrays can blow past buffer length limits
AFFECTED PACKAGES:
NUGET / MessagePack
>= 3.0.0, < 3.1.9
Fixed in: 3.1.9
NUGET / MessagePack
< 2.5.303
Fixed in: 2.5.303
> HISTORIQUE DES MODIFICATIONS
Première apparition
05/06/2026 16:16
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') - The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutr...
Nouvelle valeur:
CWE-93: Improper Neutralization of CRLF Sequences - The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectl...
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') - The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutr...
Total des modifications: 2
Dernière mise à jour: 6 days ago