---
id: "CVE-2026-111946"
kind: "vulnerability"
aliases: ["CVE-2026-111946"]
title: "Perl Plack ETag middleware leaks file inode numbers in responses"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "perl", "plack", "self-hosted"]
not_affected_if: ["default-config", "no-file-responses"]
published_at: "2026-10-19T21:17:06+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T05:10:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111946", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# Perl Plack ETag middleware leaks file inode numbers in responses

Plack::Middleware::ETag versions 0.04 through 0.05 build the default ETag header for filehandle responses from the file's inode number, modification time and size. Anyone who can request those files can read the inode numbers, which helps fingerprint the backend and correlate files across URLs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `perl -MPlack::Middleware::ETag -e 'print $Plack::Middleware::ETag::VERSION'` or `cpanm --info Plack::Middleware::ETag`
- Confirm whether the ETag middleware is loaded in your `app.psgi` and whether `file_etag` is set

## Fix

- Upgrade Plack::Middleware::ETag to `0.06` or later
- Alternatively set the `file_etag` option so the ETag no longer uses inode numbers (unknown whether this fully removes the disclosure)

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111946

## From the sources

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header.

When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_