CVE-2026-45179

Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses. If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' IP addresses may be leaked. Since version 0.9.0, the IP address is no longer logged to statsd unless configured. When configured, an HMAC signature of the IP address is logged instead.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/robrwo/Plack-Middleware-Statsd/security/advisories/GHSA-9gwm-665p-w2xx
https://metacpan.org/release/RRWO/Plack-Middleware-Statsd-v0.9.0/changes
http://www.openwall.com/lists/oss-security/2026/05/10/4

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-10 20:16

Updated : 2026-07-24 19:10

NVD link : CVE-2026-45179

Mitre link : CVE-2026-45179

CVE.ORG link : CVE-2026-45179

JSON object : View

Products Affected

No product.

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2026-45179", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45179", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T13:47:18.514129Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/robrwo/Plack-Middleware-Statsd", "vendor": "RRWO", "product": "Plack::Middleware::Statsd", "versions": [{"status": "affected", "version": "0", "lessThan": "0.9.0", "versionType": "custom"}], "packageName": "Plack-Middleware-Statsd", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}]}], "published": "2026-05-10T20:16:28.967", "references": [{"url": "https://github.com/robrwo/Plack-Middleware-Statsd/security/advisories/GHSA-9gwm-665p-w2xx", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/RRWO/Plack-Middleware-Statsd-v0.9.0/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/10/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses.\n\nIf the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' IP addresses may be leaked.\n\nSince version 0.9.0, the IP address is no longer logged to statsd unless configured. When configured, an HMAC signature of the IP address is logged instead."}, {"lang": "es", "value": "Las versiones de Plack::Middleware::Statsd anteriores a la 0.9.0 para Perl pueden filtrar direcciones IP de usuario.\n\nSi el canal de comunicaci\u00f3n con el demonio statsd no est\u00e1 protegido (por ejemplo, al enviar paquetes UDP a un host en otra red), entonces las direcciones IP de los usuarios pueden ser filtradas.\n\nDesde la versi\u00f3n 0.9.0, la direcci\u00f3n IP ya no se registra en statsd a menos que se configure. Cuando se configura, se registra en su lugar una firma HMAC de la direcci\u00f3n IP."}], "lastModified": "2026-07-24T19:10:00.160", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}