Net::Statsd::Lite versions up to 0.10.0 allow metrics generated from untrusted input to contain newlines, colons or pipes because the set_add method does not validate these characters. An attacker can embed malicious metric definitions that the Statsd server interprets as additional metrics, leading to data corruption, misleading dashboards, false alerts or automated actions based on tampered data. This vulnerability involves both CWE‑150 and CWE‑93.

The vulnerable component is the Perl module Net::Statsd::Lite supplied by RRWO. All releases of 0.10.0 and earlier are susceptible. Version 0.9.0 addressed a separate metric‑name injection issue, but the value‑based injection problem persists through 0.10.0.

The CVSS score is 7.3 and the EPSS score is < 1%, indicating a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is any channel feeding untrusted data to the set_add method, allowing an attacker to embed unwanted metric definitions. The impact is limited to integrity of monitoring data and potential operational disruption, without granting code execution or system compromise.