CVE-2026-15743
Received Received - Intake

Catalyst::Plugin::Static::Simple Public Cache Misconfiguration

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: CPANSec

Description
Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-15743
EUVD
EUVD-2026-63534

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
perl catalyst_plugin_static_simple to 0.38 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-524 The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Catalyst::Plugin::Static::Simple Perl module versions through 0.38. The _serve_static method incorrectly sets the Cache-Control header to 'public' by default, which tells proxies and caches that the content can be stored and reused for other users. This is dangerous because it may expose sensitive data to unauthorized parties if requests include Authorization headers. The module also ignores the documented method of setting expires time to 0 to disable caching.

The issue arises because the Cache-Control header cannot be overridden and the Expires header configuration is ineffective when set to 0.

Detection Guidance

Check HTTP responses from your Perl Catalyst application for the Cache-Control header set to 'public'. Use curl to inspect headers: curl -I http://your-server/static/path. If responses include 'Cache-Control: public' without override options, the system is vulnerable.

Impact Analysis

If you use the affected Catalyst::Plugin::Static::Simple module, sensitive static content could be cached by proxies and served to unauthorized users. This may lead to information disclosure if the cached content includes private data such as user-specific pages or API responses. Attackers could exploit this to access cached responses containing credentials or personal information.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by allowing unauthorized access to cached sensitive data. GDPR requires protecting personal data and ensuring it is not accessible to unauthorized parties. HIPAA mandates safeguarding protected health information. Caching such data publicly risks non-compliance with these regulations due to potential data exposure.

Mitigation Strategies

Update Catalyst::Plugin::Static::Simple to version 0.38 or later. Configure the Cache-Control header to 'no-store' or 'private' in your application settings. Set Expires to 0 to disable caching explicitly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15743. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart