CVE-2026-15743: Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable
Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable.
The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.)
Configuring the expires time to "0" to disable caching, as documented, is ignored.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to cross-user cache reuse?
Deployments using Catalyst::Plugin::Static::Simple through version 0.38 are exposed where a shared proxy or other shared cache honors the response Cache-Control header. The risk includes requests carrying an Authorization header because the responses are explicitly marked public.
Does setting the expires time to 0 prevent the issue?
No. The documented expires value of "0" is ignored by the affected _serve_static behavior, which always sets Cache-Control to "public".
What can be done before an update is available or applied?
The provided patch reference is available for version 0.38. Because the affected method offers no override for its public Cache-Control setting, assess whether a shared cache is present and prevent it from storing or reusing these responses until the patch can be applied.