CVE-2026-15743

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://datatracker.ietf.org/doc/html/rfc9111
https://github.com/perl-catalyst/Catalyst-Plugin-Static-Simple/pull/3
https://security.metacpan.org/patches/C/Catalyst-Plugin-Static-Simple/0.38/CVE-2026-15743-r1.patch
http://www.openwall.com/lists/oss-security/2026/08/20/18

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-20 19:16

Updated : 2026-08-28 16:17

NVD link : CVE-2026-15743

Mitre link : CVE-2026-15743

CVE.ORG link : CVE-2026-15743

JSON object : View

Products Affected

No product.

CWE

CWE-524

Use of Cache Containing Sensitive Information

{"id": "CVE-2026-15743", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15743", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-28T15:06:14.898370Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.1}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/perl-catalyst/Catalyst-Plugin-Static-Simple", "modules": ["Catalyst::Plugin::Static::Simple"], "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.38"}], "packageURL": "pkg:cpan/Catalyst-Plugin-Static-Simple", "packageName": "Catalyst-Plugin-Static-Simple", "programFiles": ["lib/Catalyst/Plugin/Static/Simple.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Catalyst::Plugin::Static::Simple::_serve_static"}, {"name": "Catalyst::Plugin::Static::Simple::serve_static_file"}]}]}], "published": "2026-08-20T19:16:48.700", "references": [{"url": "https://datatracker.ietf.org/doc/html/rfc9111", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/perl-catalyst/Catalyst-Plugin-Static-Simple/pull/3", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://security.metacpan.org/patches/C/Catalyst-Plugin-Static-Simple/0.38/CVE-2026-15743-r1.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/20/18", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-524"}]}], "descriptions": [{"lang": "en", "value": "Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable.\n\nThe _serve_static method always sets the Cache-Control header to \"public\", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.)\n\nConfiguring the expires time to \"0\" to disable caching, as documented, is ignored."}], "lastModified": "2026-08-28T16:17:07.540", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}