DataDog::DogStatsd for Perl libraries up to and including version 0.07 do not properly sanitize input used in the send_stats method. The library fails to strip newlines from metric names, fails to validate the content of the metric value, and fails to prevent the inclusion of newlines, pipes, and colons in tags. These deficiencies allow an attacker to craft arbitrary metric names, inject unintended metrics, and manipulate tag values, enabling the client to corrupt monitoring data and potentially mislead dashboards and alerts.

All installations of the DataDog::DogStatsd Perl library with versions through 0.07 are affected. This includes any application employing the library without additional sanitisation, regardless of the environment in which it runs.

The vulnerability can be exploited whenever untrusted data is supplied to the vulnerable methods – for example, from web form inputs or other user‑controlled sources. Because the flaw only corrupts metric data and does not provide code execution, the risk mainly concerns integrity of monitoring data and the accuracy of alert conditions. The CVSS score of 9.1 indicates a critical severity, while the EPSS score of <1% points to a low probability of exploitation. There is no publicly available exploit or listing in the CISA KEV catalog. The most likely attack vector is through application components that accept external input and forward it to the DogStatsd send_stats routine without validation. Administrators should treat the situation as a significant integrity risk, especially in environments where accurate metrics drive operational or security decisions.