The Metrics::Any::Adapter::Statsd Perl module prior to version 0.04 is vulnerable to improper neutralization of CRLF sequences (CWE-93). The statsd protocol allows multiple metrics separated by newlines in a single packet. The module's send method fails to validate metric names or values, enabling attackers to inject additional metrics by including newline and control characters such as colon and pipe in metric names. This vulnerability was addressed in version 0.04 by modifying the _make method to reject metric names containing ASCII characters below 32, colons, or pipes.

An attacker can craft metric names containing newline and control characters to inject arbitrary additional metrics into statsd packets. This could lead to inaccurate or misleading metric data being recorded or processed by monitoring systems relying on this module. No direct code execution or system compromise is indicated by the available information.

Upgrade to Metrics::Any::Adapter::Statsd version 0.04 or later, which includes validation to block metric names with ASCII control characters, colons, or pipes. Patch status is not explicitly confirmed beyond this version, so users should verify the vendor advisory for any further updates.