CVE-2026-45180 Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids
Attackers can steal session IDs if the statsd communication channel is unsecured, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45180?
CVE-2026-45180 is a high-severity vulnerability in RRWO Catalyst::Plugin::Statsd, published on 10 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids.
If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' session ids may be leaked. This may allow an attacker to use session ids as authentication tokens.
Weakness: CWE-319
Which versions are affected by CVE-2026-45180?
How do I fix CVE-2026-45180?
No fix has been published for CVE-2026-45180 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-45180 being exploited?
There is no known exploitation of CVE-2026-45180 in the wild and no public exploit code.