CVE-2026-45179CWE-319

Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses

Medium · published May 10, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses.

If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' IP addresses may be leaked.

Since version 0.9.0, the IP address is no longer logged to statsd unless configured. When configured, an HMAC signature of the IP address is logged instead.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.2th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2026-05-10T19:10Z
EPSS history
Timeline
  • 10 MAY 19:10Z
    Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses
    cvelistv5