CVE-2026-111946 Details
Description
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.
A vulnerability in Plack::Middleware::ETag versions 0.04 prior to 0.06 for Perl allows for the unintentional disclosure of file inode numbers in the default ETag header. This occurs when the response body is a filehandle and the file_etag option is not enabled. The ETag is then generated using the file's inode number, modification time, and size. Clients receiving these responses could use the exposed inode numbers for backend fingerprinting and to correlate files accessed through different URLs.
Users can upgrade to Plack::Middleware::ETag version 0.06 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/robrwo/perl-Plack-Middleware-ETag/security/advisories/GHSA-943g-rgq5-6xc8 | CPANSec | AdvisoryExploitRemedyVendor |
| https://metacpan.org/release/RRWO/Plack-Middleware-ETag-0.06/changes | CPANSec | Release Notes |
| https://www.cve.org/CVERecord?id=CVE-2003-1418 | CPANSec |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Plack::Middleware::ETag | >= 0.04, < 0.06 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | CPANSec |