CVE-2026-15743

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-15743
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15743.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-15743
Downstream
Published
2026-08-20T18:15:26.876Z
Modified
2026-08-22T03:49:37.157862633Z
Summary
Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable
Details

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable.

The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.)

Configuring the expires time to "0" to disable caching, as documented, is ignored.

Database specific 
{
    "cwe_ids": [
        "CWE-524"
    ],
    "cna_assigner": "CPANSec",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15743.json"
}
References

Affected packages

Git / github.com/perl-catalyst/catalyst-plugin-static-simple

Affected ranges

Type
GIT
Repo
https://github.com/perl-catalyst/catalyst-plugin-static-simple
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f54bb2e35be50de38bc76023f3c69e3058fc0466
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.38"
        },
        {
            "fixed": "0.38"
        }
    ]
}

Affected versions

v0.*
v0.09
v0.11
v0.13
v0.17
v0.18
v0.21
v0.22
v0.23
v0.25
v0.26
v0.27
v0.28
v0.29
v0.30
v0.31
v0.32
v0.33
v0.34
v0.35
v0.36
v0.37

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15743.json"