CVE-2026-46741 describes a vulnerability in Etsy::StatsD (a Perl module) where metric names and values are not sanitized for CRLF sequences or delimiter characters such as newlines, colons, or pipes. This improper neutralization (CWE-93) allows an attacker controlling metric input to inject additional StatsD metrics, potentially corrupting monitoring data. The issue affects all versions through 1.002002, and an unreleased version also contains similar flaws. No CVSS score or official remediation is currently available.

The vulnerability allows injection of arbitrary StatsD metrics by exploiting unsanitized input, which can lead to corrupted or misleading monitoring data. There is no indication of remote code execution or direct system compromise. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing metrics from untrusted sources or implement input validation to sanitize newline, colon, and pipe characters in metric names and values.