What is CVE-2026-50638?

CVE-2026-50638 is a critical-severity vulnerability in Pevans Metrics\, classified under CRLF Injection. CVSS score: 9.1/10. Published 2026-06-10.

How severe is CVE-2026-50638?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Pevans Metrics\

CVE-2026-50638

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metric…

Vulnerability class: CRLF Injection

EPSS: 0.003 (26.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Pevans Metrics\ — versions \
Pevans Metrics::any::adapter::dogstatsd — versions 0

Weakness classification (CWE)

References

9b29abf9-4ab0-4765-b253-1875cd9b441e (release-notes, Release Notes)
9b29abf9-4ab0-4765-b253-1875cd9b441e (related, Third Party Advisory)
9b29abf9-4ab0-4765-b253-1875cd9b441e (related, Third Party Advisory)
9b29abf9-4ab0-4765-b253-1875cd9b441e (related, Third Party Advisory)

Frequently asked questions

What is CVE-2026-50638?: CVE-2026-50638 is a critical-severity vulnerability in Pevans Metrics\, classified under CRLF Injection. CVSS score: 9.1/10. Published 2026-06-10.
How severe is CVE-2026-50638?: Critical severity. CVSS v3 base score is 9.1 out of 10.