Plack::Middleware::ETag before 0.06 leaks inodes (CVE-2026-111946)
Original title: CVE-2026-111946: Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header
Default ETag headers in versions from 0.04 before 0.06 reveal file inode numbers.
Robert Rothenberg reported on oss-security that Plack::Middleware::ETag for Perl, versions from 0.04 before 0.06, discloses file inode numbers in the default ETag header. The notice points to the module on MetaCPAN. The short post does not describe exploitation or a workaround beyond the fixed release implied by the version range.
- The flaw is tracked as CVE-2026-111946.
- Affected range stated is versions from 0.04 before 0.06.
- Disclosure is of file inode numbers via the default ETag header.
Impact: File inode numbers leaked in default ETag headers
| Product | Affected | Fixed in |
|---|---|---|
| Plack::Middleware::ETag | 0.04 before 0.06 | 0.06 |
- 1.Upgrade Plack::Middleware::ETag to 0.06.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111946 | Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header | — | — |
From the original article
Posted by Robert Rothenberg on Oct 19 ======================================================================== https://metacpan. org/dist/Plack-Middleware-ETag VCS...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.