Net::Statsd::Tiny versions before 0.3.8 do not validate metric names or values for newlines, colons, or pipes, which allows an attacker to inject arbitrary StatsD metrics. An attacker who supplies untrusted metric data could cause the library to send unintended metrics to the StatsD server, corrupting data integrity, misrepresenting monitoring dashboards, or flooding the server with unwanted metrics.

All installations of the Perl module Net::Statsd::Tiny prior to version 0.3.8. The vendor RRWO identifies the affected product. No specific operating system or environment constraints; any environment using this module and receiving untrusted metric input is susceptible.

The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, so the baseline risk in terms of exploitation probability remains low. The CVSS score of 8.2 indicates high severity. Based on the description, the likely attack vector is supply‑chain or injection via untrusted metric input, which does not require privileged access. An attacker able to control metric data can exploit the flaw remotely, injecting additional metrics and potentially affecting data integrity or causing denial‑of‑service by flooding the StatsD server.