CVE-2026-111946: Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header.
When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Plack::Middleware::ETagto a version that resolves this vulnerability.Fixed in 0.06 - Configuration
When file_etag is set, remove the use of "inode".
Plack::Middleware::ETag file_etag = exclude inode
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Plack::Middleware::ETag version 0.04 or 0.05 are exposed when they serve a response body as a filehandle and do not set the file_etag option. Under those conditions, the default ETag includes the file inode number.
What would an attacker need to obtain the disclosed information?
An attacker only needs to receive affected HTTP responses and inspect their ETag headers. No additional access is described.
How can I determine whether my application is affected?
Check whether the installed Plack::Middleware::ETag version is 0.04 or 0.05, and identify responses served from filehandles where file_etag is unset. Inspect the resulting ETag headers for values derived from inode number, modification time, and file size.
What can be done if upgrading is not immediately possible?
Set the file_etag option rather than relying on the default ETag generation for filehandle response bodies. This avoids the described default construction that includes the inode number.