PT-2026-46972 · Datadog · Dogstatsd

CVE-2026-9270 · Published 2026-06-05 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions DataDog::DogStatsd versions prior to 0.08

Description DataDog::DogStatsd does not properly sanitize input, allowing metric injections from untrusted sources. The send stats() function fails to remove newlines from the $stat variable, which enables attackers to modify the metric name prefix. Additionally, the send stats() function does not validate the content of the $delta variable, allowing for the injection of metrics, particularly when using methods that do not restrict data types, such as set, gauge, count, and histogram. The function also fails to validate tags, which may contain newlines, pipes, and colons that facilitate metric injections.

Recommendations Update to a version later than 0.07. As a temporary mitigation, avoid passing untrusted input, such as website form parameters, directly into tags or the send stats() function.

Fix

Weakness Enumeration

CWE-93

CWE-150

Related Identifiers

CVE-2026-9270

Affected Products

Dogstatsd

References · 8

• https://cve.org/CVERecord?id=CVE-2026-46719 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-46741 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-9270 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-46720 · Security Note
• https://twitter.com/VulmonFeeds/status/2062940285240238463 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2064901782556315796 · Twitter Post
• https://t.me/cveNotify/166853 · Telegram Post
• https://twitter.com/oss_security/status/2063625599369769255 · Twitter Post