Cache-Control Vulnerability in Catalyst Plugin for Perl
CVE-2026-15743

Currently unrated

Key Information:

Status
Vendor
CVE Published:
20 August 2026

What is CVE-2026-15743?

The Catalyst::Plugin::Static::Simple for Perl contains a vulnerability where the _serve_static method defaults to setting the Cache-Control header to 'public'. This misconfiguration allows proxies and other intermediaries to cache responses, which can include sensitive content even for requests that should not be cached, such as those containing an Authorization header. Furthermore, attempts to disable caching by setting expires time to '0' are ignored, exacerbating the risk of data exposure.

References

https://github.com/perl-catalyst/Catalyst-Plugin-Static-S...
issue-tracking
https://security.metacpan.org/patches/C/Catalyst-Plugin-S...
patch
https://datatracker.ietf.org/doc/html/rfc9111
technical-description

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.