CVE-2026-9270Disclosure(binary / datadog\)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch binary datadog\ systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix. The send_stats method does not validate the content of the value ($delta variable), allowing attackers to inject metrics, especially from methods that do not restrict the data type for the value, such as set, gauge, count and histogram. The send_stats method does not validate the content of the tags, which may contain newlines, pipes and colons that allow metric injections. Note that the SYNOPSIS shows an example of passing a website form "loginName" parameter as a tag, which is unsafe.

binary CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-93CWE-150

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

datadog\

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 2d ago at 1 mentions (2026-06-05); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

binary

Products

datadog\

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 3d

Signal classification3 categories

Disclosure

133.3%

General

133.3%

Patch

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-05	1	Disclosure1
2026-06-07	1	General1
2026-06-11	1	Patch1

Full discourse3 posts

Open Source Security mailing list@oss_security135d
General
Perl CPAN CVE-2026-10879: DBI before 1.648 have a heap overflow when preparsing SQL statements with more than 9 binders https://www.openwall.com/lists/oss-security/2026/06/06/4 CVE-2026-9270,CVE-2026-11362: DataDog::DogStatsd through 0.07 allow metric injections https://www.openwall.com/lists/oss-security/2026/06/06/5 & https://www.openwall.com/lists/oss-security/2026/06/06/6
Post summary
The entry lists two CVEs with basic technical details but lacks information on PoCs, patches, or active exploitation.
10000164
4.6K followersView on X
DFIR Lab@DFIR_Lab131d
Patch
🚨 CRITICAL: CVE-2026-9270 (CVSS 9.1) DataDog::DogStatsd for Perl (≤0.07) allows metric injections via unsanitized input in send_stats method. Attackers can inject metrics through names, values & tags. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/OvBPr4H7qv
Post summary
The tweet alerts about CVE-2026-9270, a critical metric injection vulnerability in DataDog::DogStatsd, and urges users to patch immediately.
0000040
44 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-9270 Metric Injection Vulnerability in DataDog::DogStatsd Perl Module Through 0.07 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9270
Post summary
A metric injection flaw has been identified in the DataDog::DogStatsd Perl module (up to v0.07). No exploit, patch, or active exploitation details are provided in this brief announcement.
0000051
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	binary	datadog\	\	-	-

Explore more

Back to dashboard binary CVEs datadog\ vulnerabilities