CVE-2026-11362

Name of the Vulnerable Software and Affected Versions DataDog::DogStatsd versions prior to 0.08

Description DataDog::DogStatsd does not properly sanitize input, which allows metric injections from untrusted sources. The format event() method, utilized by the event() method, fails to validate tag content. This lack of validation allows the injection of tags via commas, as well as metric injections through the use of newlines, pipes, and colons. An attempt to remove pipes using a regular expression is ineffective because the pipe character is not escaped, causing it to be interpreted as a metacharacter.

Recommendations Update to version 0.08 or later. As a temporary workaround, restrict the use of the format event() and event() methods with untrusted input to minimize the risk of injection.