The vulnerability stems from the Net::Async::Statsd::Client library not sanitizing metric names that include newlines, colons, or pipe characters. An attacker or any untrusted source can craft metric input that injects additional statsd metrics, resulting in corrupted or misleading monitoring data and potentially exhausting the statsd server capacity. This flaw is a form of data injection (CWE‑93) and directly affects the integrity of metrics but does not provide code execution or privilege escalation.

Net::Async::Statsd::Client for Perl, versions up to and including 0.005, is affected. No other product or version information is available in the CNA record.

Because the flaw permits injection of arbitrary metrics, it can be leveraged in environments where the client accepts data from untrusted or semi‑trusted sources. The CVSS score of 6.5 indicates moderate risk, and the EPSS score of < 1% suggests a low probability of exploitation; the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a local or remote component that can supply input to the Statsd client; if that component is compromised or misconfigured, metric injection is feasible. The CNA offers only a workaround by ensuring only trusted data is submitted, so any attempt to exploit this flaw requires bypassing that limitation.