DataDog::DogStatsd Perl modules through version 0.07 do not validate the content of tags supplied to the event method. Tags can contain commas, newlines, pipes, and colons, which the module incorrectly accepts and forwards to the DogStatsd daemon. This flaw permits an attacker controlling the tag payload to inject arbitrary metric names and values, potentially corrupting monitoring data and misleading stakeholders.

All installations of the DataDog::DogStatsd Perl client whose version is 0.07 or earlier are affected. Any environment that uses the event API to accept tags from external or untrusted sources poses a risk.

The vulnerability is exercised via the event method; an attacker who can supply event tags – for example, through an application that receives external data or through any interface that forwards tags to DogStatsd – can trigger malicious metric injection. The CVSS score is 9.8, the EPSS score is less than 1 %, and the vulnerability is not listed in CISA KEV. The likely attack vector is any exposed interface that allows untrusted tags to be sent to the DogStatsd client.