CVE-2026-45180

HIGH7.5

Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids

Published May 10, 2026

Modified 1 months ago

Details

Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids.

If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' session ids may be leaked. This may allow an attacker to use session ids as authentication tokens.

References

ADVISORY

https://github.com/robrwo/CatalystX-Statsd/security/advisories/GHSA-gjvr-hq83-fc38

WEB

https://github.com/robrwo/Plack-Middleware-Statsd/security/advisories/GHSA-9gwm-665p-w2xx

WEB

https://metacpan.org/release/RRWO/Catalyst-Plugin-Statsd-v0.10.0/changes

WEB

https://www.cve.org/CVERecord?id=CVE-2026-45179

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-45180

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

Other

CWE-319

Ecosystems

Timeline

PublishedMay 10, 2026

ModifiedMay 12, 2026

CVE-2026-45180 | Mondoo Vulnerability Intelligence