CVE-2026-50639 describes a vulnerability in Metrics::Any::Adapter::SignalFx versions prior to 0.04 for Perl, where improper neutralization of CRLF sequences (CWE-93) allows metric injection attacks. The statsd protocol and its extensions permit multiple metrics separated by newlines in a single packet. The vulnerable adapter fails to sanitize newline characters and control characters in metric labels, enabling an attacker to inject additional metrics. This vulnerability is inherited from Metrics::Any::Adapter::Statsd, which has a similar issue. The _labels function does not validate tag labels for newlines or control characters, facilitating this injection.

An attacker can inject arbitrary metrics by exploiting the lack of input sanitization in metric labels, potentially corrupting monitoring data or causing misleading metric reporting. The confidentiality and integrity of metric data are impacted (low confidentiality and integrity impact), but availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, users should avoid using vulnerable versions or implement input validation and sanitization on metric labels to neutralize CRLF sequences and control characters to prevent metric injection.