CVE-2026-111946: Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

As cited

Copy frozen at 2026-10-20 02:28 UTC (site build).

vulnerabilities

CVE-2026-111946: Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

CVE-2026-111946 affects Plack::Middleware::ETag versions 0.04 through 0.05 for Perl, where the default ETag header configuration discloses file inode numbers. This information exposure occurs in the HTTP response header and could enable attackers to gather details about the underlying filesystem structure.

Why it matters: Perl developers and operators running Plack-based web applications with affected middleware versions should upgrade to 0.06 or later to prevent information disclosure that could aid reconnaissance attacks.

Source published

2026-10-19 21:34 UTC

First seen by Cybersecurity Tracker

2026-10-20 01:30 UTC