{"id":"CVE-2026-111946","kind":"vulnerability","aliases":["CVE-2026-111946"],"related":[],"title":"Perl Plack ETag middleware leaks file inode numbers in responses","description":"Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header.\n\nWhen the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.","summary":"Plack::Middleware::ETag versions 0.04 through 0.05 build the default ETag header for filehandle responses from the file's inode number, modification time and size. Anyone who can request those files can read the inode numbers, which helps fingerprint the backend and correlate files across URLs.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","plack","self-hosted"],"not_affected_if":["default-config","no-file-responses"],"how_to_check":"- Check the installed version with `perl -MPlack::Middleware::ETag -e 'print $Plack::Middleware::ETag::VERSION'` or `cpanm --info Plack::Middleware::ETag`\n- Confirm whether the ETag middleware is loaded in your `app.psgi` and whether `file_etag` is set","fix":"- Upgrade Plack::Middleware::ETag to `0.06` or later\n- Alternatively set the `file_etag` option so the ETag no longer uses inode numbers (unknown whether this fully removes the disclosure)","status":"open","published_at":"2026-10-19T21:17:06+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T05:10:39+00:00","updated_at":"2026-10-25T05:10:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:10:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Plack::Middleware::ETag to `0.06` or later\n- Alternatively set the `file_etag` option so the ETag no longer uses inode numbers (unknown whether this fully removes the disclosure)","reach":"internet","title":"Perl Plack ETag middleware leaks file inode numbers in responses","impact":"low","summary":"Plack::Middleware::ETag versions 0.04 through 0.05 build the default ETag header for filehandle responses from the file's inode number, modification time and size. Anyone who can request those files can read the inode numbers, which helps fingerprint the backend and correlate files across URLs.","category":"package","nicknames":[],"who_cares":["perl","plack","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Server file inode numbers are disclosed in ETag headers","analyst_note":"","how_to_check":"- Check the installed version with `perl -MPlack::Middleware::ETag -e 'print $Plack::Middleware::ETag::VERSION'` or `cpanm --info Plack::Middleware::ETag`\n- Confirm whether the ETag middleware is loaded in your `app.psgi` and whether `file_etag` is set","needs_analyst":false,"not_affected_if":["default-config","no-file-responses"],"who_is_affected":"Applications running Plack::Middleware::ETag from 0.04 before 0.06 that serve file handles as response bodies without the file_etag option. Applications that do not use this middleware, or that set file_etag, are not exposed by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000623,"input_tokens":3353,"output_tokens":575,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111946':13A,16A '-2026':12A,15A '0.04':27B,74C '0.05':29B '0.06':76C 'across':67B 'affect':119C 'aid':128C 'anyon':48B 'backend':63B,129C 'bodi':91C 'build':30B 'built':106C 'client':117C 'correl':65B,132C 'cve':11A,14A 'default':32B,85C 'differ':137C 'disclos':79C,124C 'etag':3A,25B,33B,71C,86C,98C,104C 'file':6A,40B,53B,66B,80C,97C,109C,134C 'filehandl':36B,94C 'fingerprint':61B,130C 'header':34B,87C 'help':60B 'host':22B 'inod':7A,42B,57B,81C,111C,125C 'leak':5A 'may':121C 'middlewar':4A,24B,70C 'modif':44B,113C 'number':8A,43B,58B,82C,112C,126C 'option':99C 'packag':17B 'perl':1A,18B,78C 'plack':2A,19B,23B,69C 'read':55B 'receiv':118C 'request':51B 'respons':10A,37B,90C,120C 'self':21B 'self-host':20B 'serv':135C 'set':102C 'size':47B,116C 'time':45B,114C 'url':68B,138C 'use':122C 'version':26B,72C","nicknames":[],"mitigations":[],"who_affected":"Applications running Plack::Middleware::ETag from 0.04 before 0.06 that serve file handles as response bodies without the file_etag option. Applications that do not use this middleware, or that set file_etag, are not exposed by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111946","severity":null,"published_at":"2026-10-19T21:17:06+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}