Live › vulnerability › CVE-2026-111946
Go to dashboardPlack::Middleware::ETag versions 0.04 through 0.05 build the default ETag header for filehandle responses from the file's inode number, modification time and size. Anyone who can request those files can read the inode numbers, which helps fingerprint the backend and correlate files across URLs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications running Plack::Middleware::ETag from 0.04 before 0.06 that serve file handles as response bodies without the file_etag option. Applications that do not use this middleware, or that set file_etag, are not exposed by this description.
No product ranges from the sources yet.
perl -MPlack::Middleware::ETag -e 'print $Plack::Middleware::ETag::VERSION' or cpanm --info Plack::Middleware::ETagapp.psgi and whether file_etag is set0.06 or laterfile_etag option so the ETag no longer uses inode numbers (unknown whether this fully removes the disclosure)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header.
When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.
This page as .md · .json · in your agent: get_signal("CVE-2026-111946")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.