Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable
Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.
CVE-2026-15743
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-15743
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/perl-catalyst/Catalyst-Plugin-Static-Simple",
"modules": [
"Catalyst::Plugin::Static::Simple"
],
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "0.38"
}
],
"packageURL": "pkg:cpan/Catalyst-Plugin-Static-Simple",
"packageName": "Catalyst-Plugin-Static-Simple",
"programFiles": [
"lib/Catalyst/Plugin/Static/Simple.pm"
],
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "Catalyst::Plugin::Static::Simple::_serve_static"
},
{
"name": "Catalyst::Plugin::Static::Simple::serve_static_file"
}
]
}
]- Related CVEs
- CVE-2026-15743
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #39713 · Revision 1
- Added to Heist Feed
- Publisher date