CVE-2026-111946

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111946

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111946.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111946

Aliases

GHSA-943g-rgq5-6xc8

Published

2026-10-19T20:54:56Z

Modified

2026-10-20T11:16:55Z

Summary

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

Details

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header.

When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.

Database specific

{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-497"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111946.json"
}

References

Affected packages

Git / github.com/robrwo/perl-plack-middleware-etag

Affected ranges

Type

GIT

Repo

https://github.com/robrwo/perl-plack-middleware-etag

Events

Introduced

Fixed

d911a65eaf9ea30267c322ad17c93bf32f59e5c0

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.04"
        },
        {
            "fixed":  "0.06"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111946.json"