CVE-2026-46739 affects COSIMO's Net::Statsd Perl module versions prior to 0.13. The vulnerability arises from improper neutralization of CRLF sequences (CWE-93) and lack of numeric validation (CWE-150) in metric names and values. Metric names can include newline, colon, or pipe characters without restriction, enabling injection of extra statsd metrics. The update_stats and gauge methods fail to enforce numeric-only values, further facilitating metric injection. This issue can be exploited remotely without privileges or user interaction.

The vulnerability allows an attacker to inject arbitrary statsd metrics by crafting metric names or values containing special characters or non-numeric data. This can lead to inaccurate or misleading metrics being recorded, potentially affecting monitoring, alerting, or automated responses that rely on these metrics. There is no direct confidentiality or availability impact reported.

No official patch or remediation is currently documented for this vulnerability. Users should monitor the vendor advisory for updates. In the meantime, avoid using untrusted input for metric names or values in Net::Statsd versions prior to 0.13. Consider implementing input validation or sanitization at the application level to block newline, colon, pipe characters, and non-numeric values where appropriate.