What is the CVSS score of CVE-2026-45180?

CVE-2026-45180 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Catalyst::Plugin::Statsd are affected by CVE-2026-45180?

Catalyst::Plugin::Statsd versions 0.10.0 and earlier transmit session authentication tokens in cleartext over unencrypted UDP to StatsD monitoring daemons, creating a network-accessible credential…

How to fix or mitigate CVE-2026-45180?

Within 24 hours: Inventory all applications using Catalyst::Plugin::Statsd and document their version numbers and network environment (internal vs. internet-facing). Within 7 days: Isolate StatsD communication to encrypted channels (TLS/SSL) or restrict UDP traffic to trusted internal subnets using firewall rules; validate that session tokens are not being logged in StatsD metrics. Within 30 days: Migrate to a patched version when released by the vendor, or evaluate alternative Perl framework monitoring solutions that enforce encryption by default.

Catalyst::Plugin::Statsd CVE-2026-45180

EUVD-2026-28997 HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2026-05-10 CPANSec

Information Disclosure Catalyst

7.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 17:45 vuln.today

CVSS changed

May 12, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

May 10, 2026 - 20:03 nvd

UNKNOWN (no severity yet)

CVE Published

May 10, 2026 - 20:03 nvd

HIGH 7.5

DescriptionNVD

Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids.

If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' session ids may be leaked. This may allow an attacker to use session ids as authentication tokens.

AnalysisAI

Session ID disclosure in Catalyst::Plugin::Statsd for Perl (versions ≤0.10.0) occurs when the StatsD communication channel lacks encryption, leaking authentication tokens over unsecured UDP to remote StatsD daemons. CVSS 7.5 (High) reflects network-accessible confidentiality impact, but EPSS score of 0.03% (9th percentile) and SSVC assessment (no observed exploitation, partial technical impact) indicate limited real-world exploitation activity. …

RemediationAI

Within 24 hours: Inventory all applications using Catalyst::Plugin::Statsd and document their version numbers and network environment (internal vs. internet-facing). …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-45180 vulnerability details – vuln.today

Back

Catalyst::Plugin::Statsd CVE-2026-45180

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code