CVE-2026-50639 | Metrics::Any::Adapter::SignalFx versions before 0.04 for Per… | CVSS 6.5 MEDIUM

Description

Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics,separated by newlines, to be sent per packet. Metrics::Any::Adapter::SignalFx which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability. In addition, the _labels function does not check tags labels newlines or statsd control characters. The labels can be used for metric injections.

Metadata

CVE ID: CVE-2026-50639
State: PUBLISHED
Assigner: CPANSec
Reserved: 2026-06-05 12:07 UTC
Published: 2026-06-10 18:32 UTC
Last updated: 2026-06-10 19:38 UTC
Primary CWE: CWE-93
CWE-93 Improper Neutralization of CRLF Sequences
Vendor / Product: PEVANS / Metrics::Any::Adapter::SignalFx
Sources: cve.org · NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
PEVANS	Metrics::Any::Adapter::SignalFx	—	0 < 0.04

Weakness (CWE)

CWE	Source	Description
CWE-93	cna	CWE-93 Improper Neutralization of CRLF Sequences

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.5	MEDIUM	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References (3)