The DataDog::DogStatsd Perl module up to version 0.07 is vulnerable to improper neutralization of CRLF sequences (CWE-93) and related injection issues (CWE-150) in its format_event method. This method, used by the event method, does not properly sanitize event tag inputs, allowing attackers to inject metrics by including special characters such as commas, newlines, pipes, and colons. The ineffective attempt to remove pipes using an incorrect regular expression means that pipe characters remain unfiltered, facilitating injection. This vulnerability enables metric injection attacks from untrusted sources, potentially compromising the integrity of monitoring data.

The vulnerability allows attackers to inject arbitrary metrics into DataDog::DogStatsd by exploiting improper input sanitization in event tags. This can lead to corrupted or misleading monitoring data, potentially affecting alerting and operational decisions based on these metrics. There is no indication of remote code execution or direct system compromise from the provided data. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using untrusted input in event tags or implement custom sanitization to filter out commas, newlines, pipes, and colons. Monitor vendor channels for updates regarding patches or official mitigations.