Catalyst::Plugin::Statsd EUVD-2026-28997

Exploitation requires the vulnerable Catalyst::Plugin::Statsd instance to be configured with a StatsD daemon endpoint on a non-localhost network address (remote host IP or hostname across network boundaries), AND the attacker must have passive network monitoring capabilities on the transmission path between application and StatsD daemon (VLAN access, ARP spoofing, compromised network equipment, or cloud provider network access). Default localhost-only StatsD configurations are NOT vulnerable. Attack complexity is Low (AC:L) once network access exists, requiring no authentication (PR:N) or user interaction (UI:N). Limiting factors include: most production StatsD deployments use localhost or private networks with restricted access; exploitation yields session hijacking but not code execution; captured session IDs have limited lifespan based on application session timeout policies (typically 15-60 minutes).

Real-world risk is moderate despite the CVSS 7.5 High rating. The CVSS vector (AV:N/AC:L/PR:N/UI:N) correctly identifies network-based attack surface with low complexity, but exploitation requires SPECIFIC preconditions that substantially reduce practical risk: the vulnerable application must be configured to send StatsD metrics to a remote network host (non-localhost) over unencrypted channels, AND the attacker must have passive network monitoring access to the transmission path between application and StatsD daemon. EPSS score of 0.03% (9th percentile) confirms minimal observed exploitation attempts in the wild. SSVC assessment (exploitation: none, automatable: yes, technical impact: partial) further supports deprioritization - while the attack is technically automatable once network access exists, no active exploitation has been documented. CISA KEV does not list this CVE, confirming no widespread active exploitation. The primary risk applies to multi-tenant cloud environments or organizations routing StatsD metrics across untrusted network segments, which is likely a minority deployment pattern given StatsD's typical localhost/private-network architecture. Organizations using localhost-only StatsD configurations or encrypted channels (VPN/TLS tunnels) face negligible risk.

An attacker with passive network monitoring access (via compromised network infrastructure, man-in-the-middle position, or cloud tenant co-location) positions a packet capture tool on the network path between a vulnerable Catalyst application and its remote StatsD daemon. As users interact with the application, the plugin transmits unencrypted UDP packets containing session IDs to the StatsD collector. The attacker captures these UDP packets, extracts session identifiers from the cleartext payloads, and replays them as authentication cookies in HTTP requests to the Catalyst application, gaining unauthorized access to user sessions without needing credentials.