The vulnerability in Net::Async::Statsd::Client (<=0.005) arises from improper neutralization of CRLF sequences and other special characters in metric names. Because the client does not validate or sanitize metric names for newlines, colons, or pipes, an attacker controlling metric input can inject additional StatsD metrics. This can lead to metric injection attacks, potentially corrupting monitoring data. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker able to supply metric names can inject additional StatsD metrics, potentially causing inaccurate or misleading monitoring data. This could affect the integrity and reliability of metrics collected by systems using this client. There is no indication of direct impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input for metric names or implement manual sanitization to remove newline, colon, and pipe characters from metric names before passing them to Net::Async::Statsd::Client.