Executive brief
Catalyst::Plugin::Statsd is a Perl library used to send application performance metrics to a monitoring server. In affected versions, the library inadvertently includes user session IDs in the data it sends out. If this data is sent over an unencrypted network connection, an attacker could intercept these IDs and use them to hijack user accounts or gain unauthorized access to the application.
Technical details
Catalyst::Plugin::Statsd through version 0.10.0 suffers from a cleartext transmission of sensitive information vulnerability (CWE-319). The plugin transmits user session IDs to the statsd daemon as part of its telemetry data. Because statsd typically communicates via unencrypted UDP packets, an attacker positioned on the network path can sniff these packets to obtain valid session tokens. This allows for session hijacking without requiring authentication or user interaction. The issue is addressed in version 0.10.0 by removing session ID logging, or by upgrading the underlying Plack::Middleware::Statsd to version 0.9.0 which uses HMAC signatures for sensitive data.
Affected products
- RRWO Catalyst::Plugin::Statsd <= 0.10.0
Timeline
- 2026-05-10: disclosed
- 2026-05-10: advisory
- 2026-05-10: patched
References
- https://cpan.org/modules
- https://github.com/robrwo/CatalystX-Statsd/security/advisories/GHSA-gjvr-hq83-fc38
- https://github.com/robrwo/Plack-Middleware-Statsd/security/advisories/GHSA-9gwm-665p-w2xx
- https://metacpan.org/release/RRWO/Catalyst-Plugin-Statsd-v0.10.0/changes
- https://www.cve.org/CVERecord?id=CVE-2026-45179