Plack::Middleware::Statsd versions prior to 0.9.0 may leak user IP addresses due to cleartext transmission over unsecured channels to the statsd daemon. This occurs when UDP packets are sent to hosts on different networks without encryption or other protections. Starting with version 0.9.0, the middleware changes its behavior to avoid logging raw IP addresses by default, instead optionally logging an HMAC signature of the IP address if configured. The vulnerability is classified under CWE-319 (Cleartext Transmission of Sensitive Information). No vendor advisory or patch information is currently available.

The vulnerability can lead to the exposure of user IP addresses if the statsd communication channel is not secured, which may compromise user privacy. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to Plack::Middleware::Statsd version 0.9.0 or later, where IP address logging is disabled by default or replaced with an HMAC signature when configured. Additionally, securing the communication channel to the statsd daemon (e.g., avoiding sending UDP packets over untrusted networks) can mitigate the risk of IP address leakage.