PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50638 PEVANS CVE debrief

CVE-2026-50638 is a critical vulnerability in Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl. The vulnerability allows for metric injections due to the lack of protection against multiple metrics separated by newlines in a single packet. The statsd protocol and its extensions, such as dogstatsd, permit this behavior. Additionally, the _tags function does not check for newlines or statsd control characters in tags, which can also be used for metric injections. The CVSS score for this vulnerability is 9.1, indicating a critical severity.

Vendor
PEVANS
Product
Metrics::Any::Adapter::DogStatsd
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-24
Advisory published
2026-06-10
Advisory updated
2026-06-24

Who should care

Users of Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl should be concerned about this vulnerability as it can lead to metric injections, potentially causing issues with monitoring and logging.

Technical summary

The vulnerability exists in Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl. It is caused by the lack of protection against multiple metrics separated by newlines in a single packet. The statsd protocol and its extensions allow multiple metrics to be sent per packet, separated by newlines. Furthermore, the _tags function does not properly validate tags for newlines or statsd control characters, making it possible to inject metrics using tags.

Defensive priority

High

Recommended defensive actions

  • Update Metrics::Any::Adapter::DogStatsd to version 0.04 or later.
  • Validate and sanitize user input to prevent metric injections.
  • Monitor for suspicious activity and implement additional security measures as necessary.

Evidence notes

The CVE record and details were obtained from the official CVE website and the National Vulnerability Database (NVD).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-50638 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-50638

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-50638 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50638

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://metacpan.org/release/PEVANS/Metrics-Any-Adapter-Statsd-0.04/changes

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://www.cve.org/CVERecord?id=CVE-2026-50637

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9270

    9b29abf9-4ab0-4765-b253-1875cd9b441e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.