Metrics::Any::Adapter::SignalFx, an extension of Metrics::Any::Adapter::Statsd, fails to sanitize labels for metric names, allowing attackers to inject metric data via the Statsd protocol. The vulnerability, classified as CWE-93, permits the inclusion of newline and control characters in metric labels, which can be used to inject arbitrary metrics or corrupt existing metrics. This leads to data integrity issues in monitoring systems, potentially masking true system behavior or triggering false alarms.

The issue affects installations of PEVANS Metrics::Any::Adapter::SignalFx that are earlier than version 0.04. All earlier releases lack the protection against metric injection and should be considered vulnerable.

The CVSS score of 6.5, and no EPSS data is available, indicating that the exploitation probability is currently unknown. The vulnerability is exploitable over the network by sending specially crafted Statsd packets to the SignalFx endpoint, so the attack vector is remote. Since the weakness is a failure to validate input, an adversary controlling the metric stream can achieve malicious metric injection without needing elevated privileges. Although not identified in CISA’s KEV list, the lack of exploitation data suggests a moderate risk that warrants prompt remediation.