The Metrics::Any::Adapter::SignalFx Perl module prior to version 0.04 fails to properly neutralize CRLF sequences in metric labels, specifically in the _labels function. This allows an attacker to inject additional metrics by exploiting the statsd protocol's allowance for multiple metrics separated by newlines. The vulnerability is a form of CWE-93 (Improper Neutralization of CRLF Sequences) and extends a similar issue present in Metrics::Any::Adapter::Statsd. No CVSS score or official remediation is currently available.

An attacker can inject arbitrary metrics into the monitoring data stream by exploiting the lack of validation on newline and control characters in metric labels. This can lead to corrupted or misleading metrics data, potentially affecting monitoring accuracy and alerting systems that rely on these metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using untrusted input in metric labels or apply manual sanitization to remove newline and control characters from tags.