{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "DataDog-DogStatsd",
          "product": "DataDog::DogStatsd",
          "programRoutines": [
            {
              "name": "DataDog::DogStatsd::send_stats"
            },
            {
              "name": "DataDog::DogStatsd::set"
            },
            {
              "name": "DataDog::DogStatsd::gauge"
            },
            {
              "name": "DataDog::DogStatsd::count"
            },
            {
              "name": "DataDog::DogStatsd::histogram"
            }
          ],
          "repo": "https://github.com/binary-com/dogstatsd-perl",
          "vendor": "BINARY",
          "versions": [
            {
              "lessThanOrEqual": "0.07",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DataDog::DogStatsd versions through 0.07 for Perl allow metric injections.\n\nDataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.\n\nThe send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix.\n\nThe send_stats method does not validate the content of the value ($delta variable), allowing attackers to inject metrics, especially from methods that do not restrict the data type for the value, such as set, gauge, count and histogram.\n\nThe send_stats method does not validate the content of the tags, which may contain newlines, pipes and colons that allow metric injections.\n\nNote that the SYNOPSIS shows an example of passing a website form \"loginName\" parameter as a tag, which is unsafe."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93 Improper Neutralization of CRLF Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T14:49:39.714Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46741"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46719"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46720"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "DataDog::DogStatsd versions through 0.07 for Perl allow metric injections",
      "workarounds": [
        {
          "lang": "en",
          "value": "Ensure that metric names, values and tags come from trusted sources or are properly sanitised."
        }
      ],
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-9270",
    "datePublished": "2026-06-05T14:49:39.714Z",
    "dateReserved": "2026-05-22T10:23:06.050Z",
    "dateUpdated": "2026-06-05T14:49:39.714Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-9270",
      "date": "2026-06-06",
      "epss": "0.00026",
      "percentile": "0.07787"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-9270\",\"sourceIdentifier\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\",\"published\":\"2026-06-05T16:16:41.780\",\"lastModified\":\"2026-06-05T17:04:07.863\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"DataDog::DogStatsd versions through 0.07 for Perl allow metric injections.\\n\\nDataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.\\n\\nThe send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix.\\n\\nThe send_stats method does not validate the content of the value ($delta variable), allowing attackers to inject metrics, especially from methods that do not restrict the data type for the value, such as set, gauge, count and histogram.\\n\\nThe send_stats method does not validate the content of the tags, which may contain newlines, pipes and colons that allow metric injections.\\n\\nNote that the SYNOPSIS shows an example of passing a website form \\\"loginName\\\" parameter as a tag, which is unsafe.\"}],\"metrics\":{},\"weaknesses\":[{\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-93\"},{\"lang\":\"en\",\"value\":\"CWE-150\"}]}],\"references\":[{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2026-46719\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2026-46720\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2026-46741\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"}]}}"
  }
}