/ 
DataDog-DogStatsd-0.05
⭐ Starred 1 / DataDog::DogStatsd::Helper
Security Advisories (2)
CVE-2026-11362 (2026-06-05)

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)

CVE-2026-9270 (2026-06-05)

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix. The send_stats method does not validate the content of the value ($delta variable), allowing attackers to inject metrics, especially from methods that do not restrict the data type for the value, such as set, gauge, count and histogram. The send_stats method does not validate the content of the tags, which may contain newlines, pipes and colons that allow metric injections. Note that the SYNOPSIS shows an example of passing a website form "loginName" parameter as a tag, which is unsafe.

NAME

DataDog::DogStatsd::Helper - shortcut/helper for DataDog::DogStatsd

SYNOPSIS

use DataDog::DogStatsd::Helper qw(stats_inc stats_dec stats_timing stats_gauge stats_count stats_histogram)

stats_inc('logins'); # shortcut for DataDog::DogStatsd->new->increment('logins')
stats_dec('logins'); # shortcut for DataDog::DogStatsd->new->decrement('logins')
stats_timing('test.timing', 1); # ->timing
stats_gauge('test.gauge', 10); # ->gauge
stats_count('test.count', 20); # ->count
stats_histogram('test.histogram', 100); # ->histogram

DESCRIPTION

DataDog::DogStatsd::Helper is a helper for DataDog::DogStatsd, it will reuse the instance of DataDog::DogStatsd for all calls.

AUTHOR

Fayland Lam <fayland@binary.com>

COPYRIGHT

Copyright 2015- Fayland Lam

LICENSE

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

SEE ALSO