CVE-2026-15743CWE-524

CVE-2026-15743

Medium · published August 20, 2026

CVSS v3.1
5.7
EPSS
0%
Percentile
24.9
In the wild
Unconfirmed
What it is

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable.

The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.)

Configuring the expires time to "0" to disable caching, as documented, is ignored.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00322 · 24.9th percentile
Weakness
CWE-524 · Use of Cache Containing Sensitive Information
Published
2026-08-20T23:16Z
References (4)
https://datatracker.ietf.org/doc/html/rfc9111 · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://github.com/perl-catalyst/Catalyst-Plugin-Static-Simple/pull/3 · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://security.metacpan.org/patches/C/Catalyst-Plugin-Static-Simple/0.38/CVE-2026-15743-r1.patch · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttp://www.openwall.com/lists/oss-security/2026/08/20/18 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 20 AUG 18:15Z
    Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable
    cvelistv5