Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.
The values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
Note that version 0.9.0 fixed a similar issue CVE-2026-46719 for metric names.
In version 0.10.0, use the secure_set_add method which logs an HMAC digest of the value instead of the raw value.
Validate that all values sent to the client based on untrusted data do not contain metric injections.
Upgrade to Net::Statsd::Lite version 0.10.1 or later.