CVE-2026-50638

Name of the Vulnerable Software and Affected Versions Metrics::Any::Adapter::DogStatsd versions prior to 0.04

Description The software does not protect against metric injections. The statsd protocol and its extensions, such as dogstatsd, allow multiple metrics to be sent per packet when separated by newlines. This issue exists because the software extends Metrics::Any::Adapter::Statsd, which shares a similar flaw. Additionally, the tags() function fails to validate tags for newlines or statsd control characters, allowing tags to be used for metric injections.

Recommendations Update to version 0.04 or later.