If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' session ids may be leaked. This may allow an attacker to use session ids as authentication tokens.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| RRWO | Catalyst::Plugin::Statsd | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to version 0.10.0 of later, which will no longer log session ids to statsd. If Plack::Middleware::Statsd is upgraded to 0.9.0 or later and is configured to log some information securely, then session ids will be logged as HMAC signatures instead.
Workaround
Use a statsd daemon on the same host or through a secure communications channel.
Sun, 10 May 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids. If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' session ids may be leaked. This may allow an attacker to use session ids as authentication tokens. | |
| Title | Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids | |
| Weaknesses | CWE-319 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-05-10T20:03:18.315Z
Reserved: 2026-05-09T18:57:17.867Z
Link: CVE-2026-45180
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-10T21:16:29.170
Modified: 2026-05-10T21:16:29.170
Link: CVE-2026-45180
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-10T21:30:20Z