Catalyst::Plugin::Statsd versions up to 0.10.0 for Perl may transmit session IDs in cleartext over the network to the statsd daemon. If this communication is not secured (e.g., sending UDP packets over an untrusted network), session IDs can be intercepted by attackers. This cleartext transmission corresponds to CWE-319. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. There is no known exploit in the wild and no vendor-provided patch or official remediation at this time.

An attacker able to intercept network traffic between the application and the statsd daemon can capture session IDs transmitted in cleartext. These session IDs may be used as authentication tokens, potentially allowing unauthorized access to user sessions. The vulnerability affects confidentiality but does not impact integrity or availability. The high CVSS score reflects the ease of exploitation and the sensitive nature of the leaked information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should secure the communication channel to the statsd daemon, for example by using encrypted tunnels (VPN, TLS wrappers) or restricting network access to trusted hosts only. Avoid sending UDP packets containing sensitive information over untrusted networks.