CVE-2026-45179
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Plack::Middleware::Statsd before version 0.9.0 for Perl may leak user IP addresses. If the communication channel to the statsd daemon is not secured, IP addresses may be leaked. Since version 0.9.0, the IP address is no longer logged by default, and if configured, an HMAC signature is logged instead.
Risk Assessment
The risk involves potential leakage of user IP addresses, which could compromise user privacy and enable tracking.
Recommendation
It is recommended to upgrade to version 0.9.0 or later and secure the communication channel to the statsd daemon.
Original NVD description (English source)
Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses. If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' IP addresses may be leaked. Since version 0.9.0, the IP address is no longer logged to statsd unless configured. When configured, an HMAC signature of the IP address is logged instead.