CVE-2026-111946CWE-497

CVE-2026-111946

published October 20, 2026

CVSS
—
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header.

When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00170 · 6.0th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2026-10-20T01:17Z
References (3)
https://github.com/robrwo/perl-Plack-Middleware-ETag/security/advisories/GHSA-943g-rgq5-6xc8 · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://metacpan.org/release/RRWO/Plack-Middleware-ETag-0.06/changes · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://www.cve.org/CVERecord?id=CVE-2003-1418 · 9b29abf9-4ab0-4765-b253-1875cd9b441e
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 20:54Z
    Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header
    cvelistv5
  • 19 OCT 20:54Z
    Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header
    cvelistv5