CVE-2026-50638

CRITIQUE 9.1CVE-2026-50638 · Published 10/06/2026 · updated 26/10/2026

En bref

CVE-2026-50638 est une vulnérabilité CRITIQUE (CVSS 9.1) touchant metrics (pevans).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.34%, plus élevée que 27.9% des vulnérabilités.
Correctif : mettre à jour vers 0.04 ou plus récent.

Package	Affected versions	Patched versions
metrics pevans	`< 0.04`	`0.04`

Description

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapter::DogStatsd which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability. In addition, the _tags function does not check tags for newlines or statsd control characters. The tags can be used for metric injections.

References

metacpan.org/release/PEVANS/Metrics-Any-Adapter-Statsd-0.04/changes · Release Notes
cve.org/CVERecord · Third Party Advisory
cve.org/CVERecord · Third Party Advisory
cve.org/CVERecord · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free