CVE-2026-11362Disclosure(binary / datadog\)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch binary datadog\ systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)

binary CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-93CWE-150

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

datadog\

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 2d ago at 1 mentions (2026-06-05); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

binary

Products

datadog\

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Disclosure

266.7%

Patch

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-05	1	Disclosure1
2026-06-07	1	Disclosure1
2026-06-11	1	Patch1

Full discourse3 posts

Open Source Security mailing list@oss_security135d
Disclosure
Perl CPAN CVE-2026-10879: DBI before 1.648 have a heap overflow when preparsing SQL statements with more than 9 binders https://www.openwall.com/lists/oss-security/2026/06/06/4 CVE-2026-9270,CVE-2026-11362: DataDog::DogStatsd through 0.07 allow metric injections https://www.openwall.com/lists/oss-security/2026/06/06/5 & https://www.openwall.com/lists/oss-security/2026/06/06/6
Post summary
The text discloses CVE-2026-10879 (heap overflow in DBI) and CVE-2026-9270/CVE-2026-11362 (metric injection in DataDog::DogStatsd) with technical details, but provides no PoC, exploit code, patch, or evidence of active exploitation.
10000164
4.6K followersView on X
DFIR Lab@DFIR_Lab131d
Patch
🚨 CRITICAL: CVE-2026-11362 | CVSS 9.8 DataDog::DogStatsd ≤0.07 (Perl) allows metric injection via unsanitized event tags. Attackers can inject malicious metrics/tags remotely with no auth required. Patch immediately! #CVE #Vulnerability #PatchNow https://t.co/elG3DMOVEw
Post summary
The tweet announces CVE-2026-11362, a critical remote metric injection flaw in DataDog::DogStatsd that allows unauthenticated attackers to inject metrics, and urges users to patch immediately.
0000045
44 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-11362 Metric Injection Vulnerability in DataDog::DogStatsd Perl Module Through 0.07 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11362
Post summary
The text announces a new metric injection vulnerability in DataDog::DogStatsd Perl module 0.07, with no PoC, exploit, patch, or activity details reported.
0000048
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	binary	datadog\	\	-	-

Explore more

Back to dashboard binary CVEs datadog\ vulnerabilities