CVE-2026-111946

UNKNOWN 0.0

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.

CWE	CWE-497
Published	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new unknown vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/robrwo/perl-Plack-Middleware-ETag/security/advisories/GHSA-943g-rgq5-6xc8 metacpan.org: https://metacpan.org/release/RRWO/Plack-Middleware-ETag-0.06/changes cve.org: https://www.cve.org/CVERecord?id=CVE-2003-1418