Metric names and values are now validated to ensure they do not contain characters below ASCII 32 (including newlines), colon (":") or pipe ("|") characters that might allow metric injection. Offending calls now croak.

Source: Fedora 44 perl-Net-Statsd Important Metric Injection CVE-2026-46739