CVE-2026-111946

Medium

Description

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.

SeverityMedium

CVSS5.3

Exploit probability—

ProductPlack-middleware-etag

PublishedOct 19, 2026

First seenOct 19, 2026

Weakness typeCWE-497CWE-497

How to fix

Update

Plack-Middleware-ETag0.06 or later

Vendor advisories

Affected products

Product	Affected versions	Fixed in
Plack-Middleware-ETag	0.04 ≤ v < 0.06	0.06

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.