---
cve: "CVE-2026-11362"
severity: "CRITICAL"
cvss: 9.8
epss: "0.4%"
vendor: "BINARY"
kev: false
exploited: false
published: "2026-06-05 16:16:41"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T02:20:10+01:00"
---

# CVE-2026-11362

> 9.8 CRITICAL

## Beschreibung

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags.

DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources.

The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections.  (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)

## CNA-Record (Kanon, cvelistV5)

- CNA: **CPANSec**
- State: PUBLISHED
- Stand: 2026-06-08 18:20:09

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-150** — Improper Neutralization of Escape, Meta, or Control Sequences
  The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
- **CWE-93** — Improper Neutralization of CRLF Sequences
  The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

## Angriffsmuster (CAPEC)

- [CAPEC-41 — Using Meta-characters in E-mail Headers to Inject Malicious Payloads](https://capec.mitre.org/data/definitions/41.html) _(Severity: High)_
- [CAPEC-81 — Web Server Logs Tampering](https://capec.mitre.org/data/definitions/81.html) _(Severity: High)_
- [CAPEC-93 — Log Injection-Tampering-Forging](https://capec.mitre.org/data/definitions/93.html) _(Severity: High)_
- [CAPEC-134 — Email Injection](https://capec.mitre.org/data/definitions/134.html) _(Severity: Medium)_

## Referenzen

- <https://www.cve.org/CVERecord?id=CVE-2026-46741>
- <https://www.cve.org/CVERecord?id=CVE-2026-46719>
- <https://www.cve.org/CVERecord?id=CVE-2026-46720>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-11362/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_