Perl Middleware Vulnerability in Plack::Middleware::ETag
CVE-2026-111946

Currently unrated

Key Information:

Status
Vendor
CVE Published:
19 October 2026

What is CVE-2026-111946?

The Plack::Middleware::ETag module for Perl prior to version 0.06 is vulnerable to a disclosure flaw where file inode numbers are included in the default ETag header. When the response body is a filehandle and the 'file_etag' option isn't utilized, ETags are generated using the file's inode number, modification time, and size. This unintentional disclosure enables clients to correlate and fingerprint files served through different URLs, potentially leading to privacy concerns and unintended exposure of file system architecture.

References

https://github.com/robrwo/perl-Plack-Middleware-ETag/secu...
vendor-advisory
https://metacpan.org/release/RRWO/Plack-Middleware-ETag-0...
release-notes
https://www.cve.org/CVERecord?id=CVE-2003-1418
related

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.