CVE-2026-111946

Deferred Deferred - Pending Action

Information Disclosure in Plack Middleware ETag

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CPANSec

Description

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-21

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-111946

Affected Vendors & Products

Vendor	Product	Version / Range
plack_middleware	etag	From 0.04 (inc) to 0.06 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-497	The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

Executive Summary

This vulnerability affects Plack::Middleware::ETag versions from 0.04 to 0.06 for Perl. It causes the software to disclose file inode numbers in the default ETag header when the response body is a filehandle and the file_etag option is not set.

Detection Guidance

To detect this vulnerability, inspect HTTP responses for ETag headers containing file inode numbers. Check Perl applications using Plack::Middleware::ETag versions before 0.06. Review server logs for responses with ETag values derived from file metadata.

Impact Analysis

Clients receiving responses from affected systems may use the disclosed inode numbers to aid in backend fingerprinting and correlation of files served through different URLs, potentially aiding attackers in reconnaissance.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it only exposes file inode numbers in ETag headers. No evidence suggests it leads to unauthorized data access or privacy violations.

Mitigation Strategies

Upgrade Plack::Middleware::ETag to version 0.06 or later. Explicitly set the file_etag option to a non-default value to prevent inode disclosure. Audit all Perl applications using this middleware for similar issues.

Hi! I’m here to help you understand CVE-2026-111946. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70