DataDog::DogStatsd versions through 0.07 for Perl suffer from improper neutralization of CRLF sequences and insufficient input validation in the send_stats method. Specifically, newlines are not removed from metric names, metric values are not validated, and tags can contain unsafe characters such as newlines, pipes, and colons. This allows attackers to perform metric injections by crafting malicious input, including from untrusted sources like website form parameters. The vulnerability is categorized under CWE-93 (Improper Neutralization of CRLF Sequences) and CWE-150 (Improper Neutralization of Special Elements).

The vulnerability allows attackers to inject arbitrary metrics into the monitoring system by exploiting insufficient input sanitization. This can lead to corrupted or misleading metric data, potentially affecting monitoring, alerting, and operational decisions based on these metrics. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid passing untrusted input directly to the send_stats method, especially for metric names, values, and tags. Input sanitization should be implemented manually to remove newlines and other special characters before passing data to DataDog::DogStatsd.