Plack::Middleware::Statsd versions before 0.9.0 send user IP addresses to a statsd daemon without protecting the data. If the statistics service is reached over an unsecure network path, such as UDP packets sent to a host on another network, the raw IP addresses are exposed to anyone who can observe or intercept the traffic. This directly compromises user anonymity and can facilitate profiling or location attacks.

The vulnerability affects the RRWO Plack::Middleware::Statsd library for Perl in all releases prior to version 0.9.0. The resolution is to install version 0.9.0 or later; newer releases drop the automatic logging of IP addresses and optionally log an HMAC of the address when enabled.

The risk is confined to the confidentiality of client IP addresses; there is no denial of service or code execution aspect. No CVSS score is available in the advisory, but the vulnerability falls under CWE‑319, indicating the data is transmitted in the clear. The EPSS score is not provided, suggesting low or unspecified exploitation probability, and the issue is not listed in the CISA KEV catalog. Attackers can play the role of an eavesdropper on the network path to the statsd daemon. If the channel is not secured, the attack is trivial, requiring only network visibility. The best mechanism to mitigate is to update the library or reconfigure the data collection path to use a secure channel or local socket, thereby preventing exposure of credentials.