漏洞概述 CVE编号: CVE-2026-50639 发布日期: 2026-06-10 更新: 2026-06-19 标题: Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections 描述: Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow multiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapter::SignalFx which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability. In addition, the _labels function does not check tags labels newlines or statsd control characters. The labels can be used for metric injections. 影响范围 产品: Metrics::Any::Adapter::SignalFx 受影响版本: 0.03及之前版本 默认状态: 未受影响 受影响状态: 0.03及之前版本 修复方案 修复版本: 0.04 参考链接: https://metacpan.org/release/PEVANS/Metrics-Any-Adapter-Statsd-0.04/changes 相关漏洞 CVE-2026-50637: 相关漏洞 CVE-2026-50638: 相关漏洞 CVE-2026-9270: 相关漏洞 CWE分类 CWE-93: Improper Neutralization of CRLF Sequences CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences 授权数据发布者 CISA-ADP