CVE-2026-46719 affects Net::Statsd::Lite versions prior to 0.9.0, a Perl module for sending metrics to statsd. The vulnerability arises because metric names are not validated to exclude newline, colon, or pipe characters, enabling injection of additional statsd metrics from untrusted sources. This improper neutralization of CRLF sequences can lead to metric injection attacks, potentially corrupting monitoring data or causing misleading metrics.

The vulnerability allows attackers to inject arbitrary metrics into the statsd stream by exploiting the lack of input sanitization in metric names. This can lead to inaccurate monitoring data and potentially disrupt operational visibility. There is no indication of direct system compromise or denial of service from the available data.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, avoid using untrusted input as metric names in Net::Statsd::Lite. Implement input validation or sanitization at the application level to exclude newline, colon, and pipe characters from metric names.