Cyber Resilience

CVE-2026-11362

CriticalUpdated

Published: 05 June 2026

Published
05 June 2026
Modified
17 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0045 35.8th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-11362 is a critical-severity CRLF Injection (CWE-93) vulnerability in Binary Datadog\. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does not validate the content of…

more

the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)

CWE(s)
CWE-93CWE-150

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Remote code/metric injection via unsanitized tags in a network protocol client library (CVSS 9.8) directly enables exploitation of public-facing applications that consume untrusted input.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

binary
datadog\
\

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References