CVE-2026-50638 describes a critical vulnerability in Metrics::Any::Adapter::DogStatsd versions prior to 0.04 for Perl. The issue stems from improper neutralization of CRLF sequences (CWE-93) in the _tags function, which fails to sanitize tags against newlines or statsd control characters. Since the statsd protocol allows multiple metrics separated by newlines in a single packet, an attacker can inject arbitrary metrics, potentially compromising the integrity and confidentiality of metric data. This vulnerability extends from Metrics::Any::Adapter::Statsd, which has a similar issue. No patch or official remediation is currently documented.

The vulnerability allows an unauthenticated attacker to inject arbitrary metrics by exploiting the lack of input validation on tags. This can lead to unauthorized modification or insertion of metrics data, resulting in high confidentiality and integrity impact. Availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the metrics ingestion endpoint and validate or sanitize tags before sending them to Metrics::Any::Adapter::DogStatsd to mitigate injection risks.