[<prev] [next>] [day] [month] [year] [list]
Message-ID: <0a1a190b-6dbe-4b41-872d-f2263eefac22@cpansec.org>
Date: Sun, 10 May 2026 20:34:16 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-45179: Plack::Middleware::Statsd versions before 0.9.0 for
Perl may leak user IP addresses
========================================================================
CVE-2026-45179 CPAN Security Group
========================================================================
CVE ID: CVE-2026-45179
Distribution: Plack-Middleware-Statsd
Versions: before 0.9.0
MetaCPAN: https://metacpan.org/dist/Plack-Middleware-Statsd
VCS Repo: https://github.com/robrwo/Plack-Middleware-Statsd
Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user
IP addresses
Description
-----------
Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user
IP addresses.
If the communication channel to the statsd daemon is not secured (for
example, by sending UDP packets to a host on another network), then
users' IP addresses may be leaked.
Since version 0.9.0, the IP address is no longer logged to statsd
unless configured. When configured, an HMAC signature of the IP address
is logged instead.
Problem types
-------------
- CWE-319 Cleartext Transmission of Sensitive Information
Workarounds
-----------
Use a statsd daemon on the same host or through a secure communications
channel.
Solutions
---------
Upgrade to version 0.9.0 or later.
References
----------
https://github.com/robrwo/Plack-Middleware-Statsd/security/advisories/GHSA-9gwm-665p-w2xx
https://metacpan.org/release/RRWO/Plack-Middleware-Statsd-v0.9.0/changes
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
