CVE-2026-50638 describes a vulnerability in Metrics::Any::Adapter::DogStatsd versions prior to 0.04 for Perl, where the software fails to properly neutralize CRLF sequences in metric tags. The statsd protocol allows multiple metrics separated by newlines in a single packet. Because the _tags function does not validate or sanitize tags for newlines or control characters, an attacker can inject additional metrics, potentially manipulating monitoring data. This vulnerability is related to CWE-93 (Improper Neutralization of CRLF Sequences) and is inherited from a similar issue in Metrics::Any::Adapter::Statsd. There is no CVSS score or known exploits in the wild, and no official remediation or patch has been published yet.

The vulnerability allows an attacker to inject arbitrary metrics by exploiting the lack of input validation on tags, potentially corrupting monitoring data or causing inaccurate metric reporting. This could mislead monitoring systems or automated responses relying on these metrics. There is no indication of direct code execution or system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid sending untrusted or user-controlled data in metric tags to prevent injection. Monitoring for unusual metric patterns may help detect exploitation attempts.