Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections
Summary
| CVE | CVE-2026-50639 |
|---|---|
| State | PUBLISHED |
| Assigner | CPANSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-10 19:16:37 UTC |
| Updated | 2026-06-19 16:16:33 UTC |
| Description | Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapter::SignalFx which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability. In addition, the _labels function does not check tags labels newlines or statsd control characters. The labels can be used for metric injections. |
Risk And Classification
Primary CVSS: v3.1 6.5 MEDIUM from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.002520000 probability, percentile 0.162280000 (date 2026-06-21)
Problem Types: CWE-93 | CWE-150 | CWE-93 CWE-93 Improper Neutralization of CRLF Sequences | CWE-150 CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | PEVANS | MetricsAnyAdapterSignalFx | affected 0.04 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| metacpan.org/release/PEVANS/Metrics-Any-Adapter-Statsd-0.04/changes | 9b29abf9-4ab0-4765-b253-1875cd9b441e | metacpan.org | |
| www.cve.org/CVERecord | 9b29abf9-4ab0-4765-b253-1875cd9b441e | www.cve.org | |
| www.cve.org/CVERecord | 9b29abf9-4ab0-4765-b253-1875cd9b441e | www.cve.org | |
| www.cve.org/CVERecord | 9b29abf9-4ab0-4765-b253-1875cd9b441e | www.cve.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Upgrade to v0.04 or later.
There are currently no legacy QID mappings associated with this CVE.