Vulnerability · Published Aug 20, 2026 · Assigned by CPANSec
CVE-2026-15743Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable
Medium 5.7
In plain English
A medium-severity security flaw in Catalyst-Plugin-Static-Simple. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libcatalyst-plugin-static-simple-perl | no fix listed | DEBIAN-CVE-2026-15743 |
| Debian:13 | libcatalyst-plugin-static-simple-perl | no fix listed | DEBIAN-CVE-2026-15743 |
| Debian:14 | libcatalyst-plugin-static-simple-perl | 0.38-1 | DEBIAN-CVE-2026-15743 |
| Ubuntu:22.04:LTS | libcatalyst-plugin-static-simple-perl | no fix listed | UBUNTU-CVE-2026-15743 |
| Ubuntu:24.04:LTS | libcatalyst-plugin-static-simple-perl | no fix listed | UBUNTU-CVE-2026-15743 |
| Ubuntu:26.04:LTS | libcatalyst-plugin-static-simple-perl | no fix listed | UBUNTU-CVE-2026-15743 |
| Ubuntu:26.10 | libcatalyst-plugin-static-simple-perl | no fix listed | UBUNTU-CVE-2026-15743 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Catalyst-Plugin-Static-Simple | 0 – through 0.38 |
Weakness: CWE-524 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
References
- https://github.com/perl-catalyst/Catalyst-Plugin-Static-Simple/pull/3 issue-tracking
- https://security.metacpan.org/patches/C/Catalyst-Plugin-Static-Simple/0.38/CVE-2026-15743-r1.patch patch
- https://datatracker.ietf.org/doc/html/rfc9111 technical-description
- http://www.openwall.com/lists/oss-security/2026/08/20/18