Net::Statsd versions older than 0.13 for Perl do not sanitize metric names, allowing newlines, colons, or pipe characters to appear in metric identifiers. Additionally, the update_stats and gauge methods accept values without confirming that they are numeric. An attacker who can inject data sent to a StatsD server can therefore add arbitrary metric names and values, potentially flooding the monitoring system, corrupting statistics, or leaking sensitive information if metric names include confidential data. This flaw is an input validation weakness identified as CWE‑93 and also constitutes a data injection issue categorized under CWE‑150.

The affected product is Net::Statsd for Perl, versions prior to 0.13 released by the COSIMO vendor. No other vendors or versions are explicitly enumerated in the advisory.

The CVSS score is 5.3, and the EPSS score is 0.00268, indicating a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote network attacker that can send properly formatted packets to the StatsD server. The vulnerability can be exploited without special privileges or authentication, as any source able to reach the StatsD port can craft metric injections. The impact revolves around data integrity and availability of the monitoring system rather than confidentiality.