Net::Statsd::Lite versions up to 0.10.0 allow metrics generated from untrusted input to contain newlines, colons or pipes because the set_add method does not validate these characters. An attacker can embed malicious metric definitions that the Statsd server interprets as additional metrics, resulting in data corruption, misleading dashboards, false alerts or automated actions based on the tampered data. This flaw is classified as CWE‑93 – Injection via Data Manipulation.

The vulnerable component is the Perl module Net::Statsd::Lite supplied by RRWO. All releases of 0.10.0 and earlier are susceptible. The 0.9.0 release addressed a separate metric‑name injection issue; however, the value‑based injection problem persists through 0.10.0.

The CVSS score is 7.3 and the EPSS score is < 1%, indicating a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is any channel that feeds untrusted data to the set_add method, allowing an attacker to embed unwanted metric definitions. The impact is limited to integrity of monitoring data and potential operational disruption, without granting code execution or system compromise.