CVE-2026-50637

Name of the Vulnerable Software and Affected Versions Metrics::Any::Adapter::Statsd versions prior to 0.04

Description The software does not protect against metric injections. The statsd protocol allows multiple metrics to be sent per packet, separated by newlines. The send() method fails to validate the contents of metric names or values. If names contain newlines or statsd control characters such as colons or pipes, metric injections can occur. This is caused by the make() method not blocking characters below ASCII 32, colons, or pipes.

Recommendations Update to version 0.04.