Net::Statsite::Client versions through 1.1.0 contain a flaw that allows metric injection because newline, colon, and pipe characters are not removed or sanitized from metric names and values. This omission permits an attacker to craft messages that introduce additional metrics or alter the format of metric transmissions, which can lead to unexpected metric collection, resource exhaustion, or interference with monitoring infrastructure. The weakness is linked to CWE‑150 and CWE‑93 weaknesses regarding improper validation of input data.

The affected product is JASEI's Net::Statsite::Client. All releases up to and including version 1.1.0 are vulnerable. No other versions are listed as affected.

The CVSS score is not present and EPSS data is unavailable, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector requires the ability to influence data passed to the Net::Statsite::Client library, typically through a local application that uses the client. Based on the description, the dependency on untrusted input is inferred; the threat model assumes that an attacker can manipulate the data sent to the client. If an application exposes untrusted input to the client, an attacker could exploit the injection locally but remote exploitation would require additional conditions that are not documented in the description.