Net::Statsd::Lite versions prior to 0.9.0 allow attackers to inject arbitrary statistics metrics. The library does not validate metric names for newlines, colons, or pipe characters, so an attacker can craft metric strings that appear as multiple distinct metrics or alter existing ones. This flaw can distort monitoring data, potentially leading to misdiagnosis, false alarms, or resource exhaustion if metrics are logged or processed excessively.

The vulnerable component is the Perl module Net::Statsd::Lite, distributed by RRWO. Any installation using a version older than 0.9.0 is affected. The fix was released in version 0.9.0 and later.

No CVSS score is provided and the EPSS score is unavailable, but the vulnerability is listed as not included in CISA's KEV catalog. Exploitation requires the ability to send metrics through the vulnerable library to a StatsD server, which is typically remote. Attackers can inject new metric entries or alter existing ones by including newline, colon, or pipe characters in the metric name. While this does not enable remote code execution, it can lead to integrity and availability issues in monitoring systems.