CVE-2026-50639

Vulnerability

Versions of Metrics::Any::Adapter::SignalFx for Perl before 0.04 are vulnerable to metric injection. The statsd protocol allows multiple metrics per packet, separated by newlines. The _labels function in this adapter does not properly sanitize newline characters or statsd control characters within metric or label names, enabling injection attacks [1].

Exploitation

An attacker can exploit this vulnerability by sending specially crafted metric data containing newline characters or statsd control characters within metric or label names. This data would be sent over the statsd protocol to the vulnerable adapter, triggering the injection [1].

Impact

Successful exploitation allows an attacker to inject arbitrary metrics into the monitoring system. This could lead to data manipulation, denial of service by overwhelming the system with injected metrics, or potentially misinterpretation of monitoring data, impacting the CIA triad of the affected system.

Mitigation

Metrics::Any::Adapter::SignalFx version 0.04, released on 2026-06-06, addresses this vulnerability by fixing the handling of disallowed characters in metric and label names [1]. Users should upgrade to version 0.04 or later. No workarounds are specified in the available references.