Plack::Middleware::Statsd EUVD-2026-28995

Exploitation requires three specific conditions: (1) Plack::Middleware::Statsd version 0.8.x or earlier must be in use and configured to log IP addresses (the vulnerable versions default to sending IPs to statsd); (2) the statsd daemon must be reachable from the attacker's network position - either on the same physical/virtual network segment, a trusted peering network, or accessible via public routing if configured to listen on non-localhost interfaces; (3) the communication channel must be unencrypted and unvalidated (standard UDP with no TLS wrapper or mutual authentication). The vulnerability does NOT require authentication to the application, does NOT require special privileges, and does NOT depend on user interaction. However, it is limited by the attacker's ability to observe network traffic (requires packet capture capability on the same network segment as either the application or statsd daemon, or a position between them) and by whether IP logging is explicitly configured in the middleware (some deployments may disable it). Default deployments with statsd on localhost or isolated networks are NOT exploitable; exposure is specific to external or multi-tenant network deployments.

This vulnerability presents low real-world exploitation risk despite moderate CVSS scoring. The CVSS 5.3 score reflects network-accessible information disclosure (AV:N/AC:L/PR:N/UI:N, confidentiality impact low), but the EPSS score of 0.01% (0th percentile) indicates minimal observed exploitation activity. The vulnerability requires specific network conditions to be exploitable: the statsd daemon must be reachable from an attacker's network position, and the attacker must actively monitor network traffic. This is not opportunistic remote code execution - it requires network-layer access and packet interception capability. For organizations with statsd daemons deployed on isolated internal networks or with network segmentation in place, the practical risk is substantially lower than the CVSS score suggests. However, for applications exposing statsd communication to untrusted networks or cloud environments, the information disclosure of user IP addresses constitutes a privacy concern, particularly in jurisdictions with GDPR or similar regulations treating IP addresses as personally identifiable information. The lack of public POC code and zero KEV status confirm this is not a widely weaponized vulnerability.

An attacker on the same network as a Plack application's statsd daemon (e.g., cloud VPC, corporate LAN, or compromised adjacent VM) passively sniffs UDP traffic on port 8125 where statsd listens. The attacker observes unencrypted packets containing user IP addresses embedded in metric names or values transmitted by vulnerable versions of Plack::Middleware::Statsd. The attacker logs these IP addresses for profiling, tracking, or correlation with other breaches.