CVE-2026-15743
Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable
Description
Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.
INFO
Published Date :
Aug. 20, 2026, 6:15 p.m.
Last Modified :
Aug. 20, 2026, 6:15 p.m.
Remotely Exploit :
No
Source :
CPANSec
Affected Products
The following products are affected by CVE-2026-15743
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Catalyst::Plugin::Static::Simple module.
- Configure cache control settings appropriately.
- Verify the Cache-Control header is not set to public.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-15743 vulnerability anywhere in the article.