Net::Statsd::Lite versions before 0.9.0 for Perl do not properly sanitize metric names, allowing injection of additional statsd metrics via untrusted input containing newline, colon, or pipe characters. This is classified as CWE-93: Improper Neutralization of CRLF Sequences. The vulnerability could be exploited to manipulate or inject metrics data, potentially impacting monitoring accuracy or system behavior relying on these metrics. There is no CVSS score assigned, no vendor advisory or patch information available, and no known active exploitation.

The vulnerability allows injection of additional statsd metrics by exploiting improper input validation of metric names. This could lead to inaccurate or misleading monitoring data, potentially affecting system monitoring and alerting processes. There is no evidence of active exploitation or direct compromise beyond metric injection. The impact is primarily on the integrity of metrics data collected by Net::Statsd::Lite.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using untrusted input as metric names or implement input validation to sanitize newline, colon, and pipe characters in metric names to prevent injection. Monitor vendor channels for updates regarding patches or official mitigations.