Mojolicious::Plugin::Statsd versions up to 0.04 are vulnerable to improper neutralization of CRLF sequences (CWE-93) in metric names and values, allowing injection of additional statsd metrics. This occurs because the plugin fails to check for newline, colon, or pipe characters in metrics, which can be exploited if metrics originate from untrusted sources. The vulnerability is mitigated in version 0.06 by replacing the internal statsd client with a separate client (Net::Statsd::Tiny) that fixes a related vulnerability (CVE-2026-46720).

An attacker able to supply metric names or values could inject additional statsd metrics, potentially corrupting monitoring data or causing misleading statistics. There is no indication of remote code execution or system compromise from this vulnerability. No known exploits are reported in the wild.

No official patch or vendor advisory is currently available. Users should upgrade to Mojolicious::Plugin::Statsd version 0.06 or later, which replaces the vulnerable statsd client with a fixed version. Until then, avoid processing metrics from untrusted sources or implement input validation to block newline, colon, and pipe characters in metric names and values. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.