Vulnerability · Published Oct 19, 2026 · Assigned by CPANSec

CVE-2026-111946Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

Medium 5.3

In plain English

A medium-severity security flaw in Plack-Middleware-ETag. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 72.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.

Affected products (as reported)

Vendor	Product	Versions
	Plack-Middleware-ETag	0.04 – before 0.06

Weakness: CWE-497 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/robrwo/perl-Plack-Middleware-ETag/security/advisories/GHSA-943g-rgq5-6xc8 vendor-advisory
https://metacpan.org/release/RRWO/Plack-Middleware-ETag-0.06/changes release-notes
https://www.cve.org/CVERecord?id=CVE-2003-1418 related