Executive brief
Plack::Middleware::Statsd is a Perl component used to send performance statistics from web applications to a monitoring server. In older versions, the software sends the IP addresses of website visitors in plain text over the network. If the connection to the monitoring server is not encrypted, an attacker could intercept this traffic to track user activity and compromise visitor privacy.
Technical details
Plack::Middleware::Statsd prior to version 0.9.0 is vulnerable to cleartext transmission of sensitive information (CWE-319). The middleware logs raw user IP addresses to a statsd daemon; if the communication channel (typically UDP) is not secured or traverses untrusted networks, these addresses can be intercepted via network sniffing. An attacker with access to the network path between the application and the statsd server can collect visitor IP data without authentication. The vulnerability is resolved in version 0.9.0, which disables IP logging by default and uses HMAC signatures when logging is enabled.
Affected products
- RRWO Plack::Middleware::Statsd < 0.9.0
Timeline
- 2026-05-10: disclosed
- 2026-05-10: advisory
- 2026-05-10: patched: Fixed in version 0.9.0