CVE-2026-11362: Binary Datadog XSS Vulnerability

CVE-2026-11362 Overview

CVE-2026-11362 affects the DataDog::DogStatsd Perl module through version 0.07. The module fails to sanitize event tag input, enabling attackers to inject arbitrary metrics through untrusted data sources. The format_event method, invoked by the event method, does not validate tag content for commas, newlines, pipes, or colons. An attempt to strip pipes using s/|//g is ineffective because the pipe is treated as a regular expression metacharacter rather than a literal character. This vulnerability falls under [CWE-93] (Improper Neutralization of CRLF Sequences) and allows attackers to corrupt metrics pipelines or inject false telemetry.

Critical Impact
Remote attackers can inject arbitrary metrics and tags into DogStatsd event streams by supplying crafted input containing pipes, commas, colons, or newlines through untrusted data sources.

Affected Products

DataDog::DogStatsd for Perl, all versions through 0.07
Perl applications using the event method with untrusted tag input
Monitoring pipelines consuming metrics from affected DogStatsd Perl clients

Discovery Timeline

2026-06-05 - CVE-2026-11362 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-11362

Vulnerability Analysis

The DataDog::DogStatsd module formats events and metrics for transmission to a DogStatsd agent using a pipe-delimited wire protocol. The format_event method assembles event payloads from caller-supplied fields, including tags. Tag values pass through the formatter without proper neutralization of protocol-significant characters.

An attacker who controls any portion of the tag content can break out of the tag field and inject additional tags, terminate the current event, and append entirely new metrics. The wire protocol uses pipes (|) as field separators, colons (:) as metric-value separators, commas (,) as tag delimiters, and newlines as record terminators. Each of these characters reaches the wire unescaped when supplied through tags.

Root Cause

The sanitization logic in format_event contains a flawed regular expression. The substitution s/|//g is intended to remove pipe characters from tag content. However, the pipe character is a regex metacharacter denoting alternation. Unescaped, the pattern matches an empty string at every position, removing nothing. A correct implementation would use s/\|//g or tr/|//d. This single character bug eliminates the only defense against protocol injection in the tag handling path.

Attack Vector

Any application using DataDog::DogStatsd to emit events containing user-controlled or externally-sourced tag data is exploitable. Attack inputs commonly originate from HTTP headers, form fields, log entries, or upstream API responses that are later attached as tags for observability purposes. A crafted tag value containing |#injected_tag,attacker.metric:9999|c\n terminates the legitimate event payload and injects a counter metric of the attacker's choosing. Downstream monitoring systems treat the forged metrics as authoritative, enabling telemetry poisoning, alert suppression, or alert flooding.

No proof-of-concept exploit code has been published for this vulnerability. Refer to the CVE record for additional technical context.

Detection Methods for CVE-2026-11362

Indicators of Compromise

Unexpected metric names appearing in Datadog dashboards that do not correspond to instrumented application code
Tag cardinality spikes on events emitted from Perl services using DataDog::DogStatsd
DogStatsd payloads containing embedded newline, pipe, or colon characters within tag fields captured at the network layer

Detection Strategies

Audit application source for calls to DogStatsd::event where the tags argument originates from request parameters, headers, or other untrusted sources
Capture UDP traffic to the DogStatsd agent and inspect for tag fields containing unescaped protocol delimiters
Compare emitted metric names against an allowlist derived from static analysis of application code

Monitoring Recommendations

Forward DogStatsd agent logs to a centralized analytics platform and alert on unknown metric names
Enable rate-limit and cardinality alerts in Datadog to surface anomalous metric or tag growth tied to injection activity
Monitor application logs for input values containing |, \n, ,, or : characters destined for tag fields

How to Mitigate CVE-2026-11362

Immediate Actions Required

Inventory all Perl services depending on DataDog::DogStatsd and identify call sites passing untrusted data as tags
Apply input validation at the application layer to reject or strip |, ,, :, and newline characters from tag values before invoking the module
Treat metrics ingested from affected services as untrusted until a fixed release is deployed

Patch Information

No fixed version has been published in the NVD record at the time of disclosure. Consult the CVE record and the module's CPAN distribution for current release status. Until a patched version is available, the workarounds below provide the only mitigation.

Workarounds

Wrap calls to DogStatsd::event with a sanitizer that applies tr/|,:\n\r//d to every tag value
Restrict tag values to an allowlist of alphanumeric characters, underscores, and hyphens
Replace the event method emission path with a wrapper that validates tag format against the documented Datadog tag specification before transmission

bash

# Example tag sanitizer in Perl (wrapper pattern)
use DataDog::DogStatsd;
my $statsd = DataDog::DogStatsd->new();

sub safe_tags {
    my @tags = @_;
    for (@tags) { tr/|,:\n\r//d; }
    return \@tags;
}

$statsd->event('title', 'text', { tags => safe_tags($user_input) });