Net::Statsd versions older than 0.13 for Perl do not sanitize metric names, allowing newlines, colons, or pipe characters to appear in metric identifiers. In addition, the update_stats and gauge methods accept values without confirming that they are numeric. An attacker who can inject data sent to a StatsD server can therefore add arbitrary metric names and values, potentially flooding the monitoring system, corrupting statistics, or leaking sensitive information if metric names include confidential data. This flaw is a form of input validation weakness identified as CWE‑93.

The affected product is Net::Statsd for Perl, versions prior to 0.13 released by the COSIMO vendor. No other vendors or versions are explicitly enumerated in the advisory.

The CVSS score is 5.3, and the EPSS score is unavailable. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote network attacker that can send properly formatted packets to the StatsD server. The vulnerability can be exploited without special privileges or authentication, as any source able to reach the StatsD port can craft metric injections. The impact revolves around data integrity and availability of the monitoring system rather than confidentiality.