What’s Vulnerable › Vulnerabilities

CVE-2026-111946: Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-19 · updated 2026-10-29
• Weakness: CWE-497

Description

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.

Affected products

• Plack-Middleware-ETag: from 0.04 before 0.06 — fixed in 0.06

How to fix

Upgrade to a fixed version: Plack-Middleware-ETag 0.06. Check the vendor advisory for mitigations.

References

• https://github.com/robrwo/perl-Plack-Middleware-ETag/security/advisories/GHSA-943g-rgq5-6xc8
• https://metacpan.org/release/RRWO/Plack-Middleware-ETag-0.06/changes
• https://www.cve.org/CVERecord?id=CVE-2003-1418

Get alerted when CVE-2026-111946 or the next vulnerability affects your stack