Net::Async::Statsd::Client versions through 0.005 for Perl do not validate or sanitize metric names for newline (CRLF), colon, or pipe characters. This allows an attacker controlling metric names to inject additional StatsD metrics by exploiting improper neutralization of CRLF sequences, classified under CWE-93. The vulnerability could lead to metric injection attacks, potentially corrupting monitoring data or causing misleading metrics reporting. No CVSS score or vendor patch information is available at this time.

The vulnerability allows injection of additional StatsD metrics via crafted metric names containing CRLF sequences or special characters. This can result in corrupted or misleading monitoring data, which may affect the reliability of metrics-based monitoring or alerting systems relying on StatsD data. There are no reports of exploitation in the wild, and the impact is limited to the integrity of metrics data rather than direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using untrusted input as metric names or implement input validation/sanitization to remove newline, colon, and pipe characters from metric names before sending them to Net::Async::Statsd::Client.