The vulnerability in Metrics::Any::Adapter::Statsd (CVE-2026-50637) is an improper neutralization of CRLF sequences (CWE-93) that allows metric injection attacks. The statsd protocol permits multiple metrics separated by newlines in one packet. The affected versions prior to 0.04 do not validate metric names or values, allowing injection of additional metrics by including newline and control characters. This can lead to integrity issues with metrics data. The fix in version 0.04 modifies the _make method to block metric names containing ASCII control characters below 32, colons, or pipes, preventing injection.

An attacker can inject arbitrary metrics by exploiting the lack of input validation, potentially corrupting or manipulating monitoring data. The CVSS score of 8.2 (high) reflects that this can be exploited remotely without privileges or user interaction, leading to low confidentiality impact but high integrity impact. There is no indication of availability impact. No known exploits in the wild have been reported.

Upgrade to Metrics::Any::Adapter::Statsd version 0.04 or later, which includes validation to block metric names with ASCII control characters, colons, or pipes. Since no official patch link or advisory is provided, verify the version in use and update accordingly. Patch status is not explicitly confirmed by a vendor advisory, but the description states version 0.04 fixes the issue.