CVE-2026-45180 Details
Description
Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids. If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' session ids may be leaked. This may allow an attacker to use session ids as authentication tokens.
A vulnerability exists in Catalyst::Plugin::Statsd for Perl, affecting versions prior to 0.10.0, where session IDs may be leaked over unsecured communication channels to the statsd daemon. This leakage could allow an attacker to use the session IDs as authentication tokens. The issue arises if UDP packets are sent to a host on another network without proper security measures.
Users are advised to upgrade to Catalyst::Plugin::Statsd version 0.10.0 or later, which no longer logs session IDs to statsd. If Plack::Middleware::Statsd is upgraded to version 0.9.0 or later and configured to log information securely, session IDs will be logged as HMAC signatures instead. Alternatively, a statsd daemon can be used on the same host or through a secure communications channel.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 10, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/robrwo/CatalystX-Statsd/security/advisories/GHSA-gjvr-hq83-fc38 | CPANSec | AdvisoryRemedyVendor |
| https://github.com/robrwo/Plack-Middleware-Statsd/security/advisories/GHSA-9gwm-665p-w2xx | CPANSec | AdvisoryNot ApplicableVendor |
| https://metacpan.org/release/RRWO/Catalyst-Plugin-Statsd-v0.10.0/changes | CPANSec | Release NotesVendor |
| https://www.cve.org/CVERecord?id=CVE-2026-45179 | CPANSec | AdvisoryNot Applicable |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-319 | Cleartext Transmission of Sensitive Information | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Catalyst::Plugin::Statsd | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CISA-ADP |
| May 10, 2026 | New CVE Received | CPANSec |