Etsy::StatsD libraries for Perl up to 1.002002 do not sanitize metric names and values for newlines, colons, or pipe characters, allowing an attacker to inject additional metrics into the StatsD stream. If untrusted data is submitted, the library interprets injected delimiters as separate metrics, potentially leading to inaccurate monitoring data or denial of service through excessive metric creation.

The vulnerability affects the SANBEG Etsy::StatsD Perl library, specifically all releases through version 1.002002. An unreleased development build also contains gauge and set methods that lack protection against injection, meaning any environment using the current or older releases is susceptible.

The CVSS score of 7.5 indicates significant severity, and the EPSS score is less than 1%, indicating a low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting limited exposure data. If an application can cause the library to process inputs from untrusted sources, an attacker can inject arbitrary metrics. The likely attack vector is any input forwarded to the StatsD client, whether from user traffic, external services, or internal data feeds. Exploitation requires only the ability to influence metric submissions, a condition that may arise in many server or monitoring setups that forward untrusted data to Etsy::StatsD.