If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' IP addresses may be leaked.
Since version 0.9.0, the IP address is no longer logged to statsd unless configured. When configured, an HMAC signature of the IP address is logged instead.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| RRWO | Plack::Middleware::Statsd | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to version 0.9.0 or later.
Workaround
Use a statsd daemon on the same host or through a secure communications channel.
Sun, 10 May 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses. If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' IP addresses may be leaked. Since version 0.9.0, the IP address is no longer logged to statsd unless configured. When configured, an HMAC signature of the IP address is logged instead. | |
| Title | Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses | |
| Weaknesses | CWE-319 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-05-10T21:17:03.221Z
Reserved: 2026-05-09T18:57:17.867Z
Link: CVE-2026-45179
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-10T20:16:28.967
Modified: 2026-05-10T20:16:28.967
Link: CVE-2026-45179
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-10T20:30:19Z