[<prev] [next>] [day] [month] [year] [list]
Message-ID: <b3c76072-40bd-49da-ac79-470467d9aa49@cpansec.org>
Date: Sun, 10 May 2026 21:07:36 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-45180: Catalyst::Plugin::Statsd versions through 0.10.0 for
Perl may leak session ids
========================================================================
CVE-2026-45180 CPAN Security Group
========================================================================
CVE ID: CVE-2026-45180
Distribution: Catalyst-Plugin-Statsd
Versions: through 0.10.0
MetaCPAN: https://metacpan.org/dist/Catalyst-Plugin-Statsd
VCS Repo: https://github.com/robrwo/CatalystX-Statsd
Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak
session ids
Description
-----------
Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak
session ids.
If the communication channel to the statsd daemon is not secured (for
example, by sending UDP packets to a host on another network), then
users' session ids may be leaked. This may allow an attacker to use
session ids as authentication tokens.
Problem types
-------------
- CWE-319 Cleartext Transmission of Sensitive Information
Workarounds
-----------
Use a statsd daemon on the same host or through a secure communications
channel.
Solutions
---------
Upgrade to version 0.10.0 of later, which will no longer log session
ids to statsd.
If Plack::Middleware::Statsd is upgraded to 0.9.0 or later and is
configured to log some information securely, then session ids will be
logged as HMAC signatures instead.
References
----------
https://github.com/robrwo/CatalystX-Statsd/security/advisories/GHSA-gjvr-hq83-fc38
https://metacpan.org/release/RRWO/Catalyst-Plugin-Statsd-v0.10.0/changes
https://www.cve.org/CVERecord?id=CVE-2026-45179
https://github.com/robrwo/Plack-Middleware-Statsd/security/advisories/GHSA-9gwm-665p-w2xx
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
