Net::Statsd::Lite versions up to 0.10.0 for Perl contain an improper neutralization of CRLF sequences vulnerability (CWE-93) in the set_add method. The method fails to validate or sanitize input values for newline characters, colons, or pipe characters, enabling an attacker to inject additional StatsD metrics if untrusted data is passed. This vulnerability is related to a previously fixed issue (CVE-2026-46719) that addressed similar injection risks in metric names. There is no CVSS score assigned and no vendor advisory or patch information currently available.

The vulnerability allows injection of additional StatsD metrics through unsanitized input values, potentially leading to inaccurate or manipulated metric data. There is no indication of remote code execution or direct system compromise. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid passing untrusted input to the set_add method or implement their own input validation to sanitize newline, colon, and pipe characters in metric values.