CVE-2026-46741 affects Etsy::StatsD Perl module versions up to and including 1.002002. The vulnerability arises because metric names and values are not checked for newline, colon, or pipe characters, enabling attackers to inject additional StatsD metrics. This improper neutralization of CRLF sequences (CWE-93) can lead to metric injection attacks. The git repository contains an unreleased version with gauge and set methods that also lack proper validation, indicating the issue may persist in development versions. No official fix or patch has been published as of the data provided.

An attacker able to supply metric names or values can inject arbitrary StatsD metrics, potentially corrupting monitoring data or causing misleading statistics. The CVSS score of 7.5 (high) reflects the ease of remote exploitation without privileges or user interaction and the impact on integrity. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid accepting metric input from untrusted sources or implement input validation/sanitization to block newline, colon, and pipe characters in metric names and values.