CVE-2026-111946
Last modified
CVE-2026-111946 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | — | >= 0.04, < 0.06 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-111946?
How severe is CVE-2026-111946?
How do I fix CVE-2026-111946?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-111937Frappe CRM before 1.81.2 contains a missing authorization vu…5.4
- CVE-2026-111938Frappe CRM before 1.74.0 contains a missing authorization vu…4.3
- CVE-2026-111939Frappe Helpdesk before 1.26.0 contains an authorization bypa…4.6
- CVE-2026-11194Inappropriate implementation in Network in Google Chrome pri…6.5
- CVE-2026-111942A weakness has been identified in hrisikeshpal Blood_Bank_Ma…4.3
- CVE-2026-111943On most platforms, Go uses the given system root certificate…6.8
- CVE-2026-111947The Pricing Table WordPress Plugin WordPress plugin before …5.5
- CVE-2026-111948The User Profile Builder WordPress plugin before 4.0.1 does…7.1
- CVE-2026-111949The miniOrange 2FA WordPress plugin before 6.3.1 does not p…7.5
- CVE-2026-11195Inappropriate implementation in MHTML in Google Chrome prior…6.5
- CVE-2026-111955The WholesaleX WordPress plugin before 3.0.9 does not check…6.5
- CVE-2026-111956The WholesaleX WordPress plugin before 3.0.9 does not prote…5.9
Are you affected by CVE-2026-111946?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST