CVE-2026-15743
Description
A flaw was found in Catalyst::Plugin::Static::Simple for Perl. The _serve_static method incorrectly sets the Cache-Control header to "public" for all responses. This misconfiguration allows intermediate proxies to store sensitive content, including responses from authenticated sessions, in shared caches. Consequently, an attacker could potentially access confidential information intended for other users, leading to unauthorized information disclosure.
Statement
Red Hat rates this vulnerability as Important because unauthenticated remote attackers can retrieve sensitive session data retained by intermediate shared caching proxies. Because intermediate proxies cache and serve private application responses without requiring privileges or user interaction, this flaw poses a high confidentiality risk across shared networks. The affected perl-Catalyst-Plugin-Static-Simple package is not shipped or supported in Red Hat Enterprise Linux products.
Mitigation
To mitigate this issue, configure any upstream web server or reverse proxy (e.g., Apache HTTP Server, Nginx) to explicitly override or remove the `Cache-Control: public` header for paths serving sensitive or authenticated content from applications using `Catalyst::Plugin::Static::Simple`. This ensures that responses are not publicly cached, preventing unauthorized information disclosure. Consult your web server or proxy documentation for specific header manipulation directives.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
