Etsy::StatsD libraries for Perl versions up to 1.002002 do not sanitize metric names and values for newlines, colons, or pipe characters, allowing an attacker to inject additional metrics into the StatsD stream. If untrusted data is submitted, the library will interpret injected delimiters as separate metrics, potentially leading to inaccurate monitoring data or denial of service through excessive metric creation.

The vulnerability affects the SANBEG Etsy::StatsD Perl library, specifically all releases through version 1.002002. An unreleased development build also contains gauge and set methods that lack protection against injection, meaning any environment using the current or older releases is susceptible.

The CVSS score of 7.5 indicates significant severity, but the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating limited exposure data. However, if an application can cause the library to process inputs originating from untrusted sources, an attacker can inject arbitrary metrics. The attack vector is likely through any input that is forwarded to the StatsD client, whether from user traffic, external services, or internal data feeds. Exploitation requires only the ability to influence metric submissions, a condition that may arise in many server or monitoring setups that forward untrusted data to Etsy::StatsD.