CVE-2026-50638

CriticalCVSS 9.1/10Last modified Jun 24, 2026

Description

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections.

The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet.

Metrics::Any::Adapter::DogStatsd which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability.

In addition, the _tags function does not check tags for newlines or statsd control characters. The tags can be used for metric injections.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-93CWE-150

Affected software

No affected versions have been published.

Timeline

Published
Jun 10, 2026
Last modified
Jun 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-506396.5Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensioCVE-2026-50648.5Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow foCVE-2026-506417.1Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, usCVE-2026-506424.8diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGCVE-2026-506435.18cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compiler accepts attacker-cCVE-2026-506448.6SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL comCVE-2026-506457.5There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can leadCVE-2026-506467.8Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.CVE-2026-506477.5Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deCVE-2026-506487.5Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.CVE-2026-506497.8Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.CVE-2026-50658.8IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses fo
CVE-2026-50638: Critical severity, CVSS 9.1 | Vulnix