CVE-2026-15743

Name	CVE-2026-15743
Description	Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libcatalyst-plugin-static-simple-perl (PTS)	bullseye	0.36-1	vulnerable
	bookworm, forky, trixie	0.37-1	vulnerable
	sid	0.38-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libcatalyst-plugin-static-simple-perl	source	(unstable)	(unfixed)

Notes

https://lists.security.metacpan.org/cve-announce/msg/42860527/
https://github.com/perl-catalyst/Catalyst-Plugin-Static-Simple/pull/3
https://security.metacpan.org/patches/C/Catalyst-Plugin-Static-Simple/0.38/CVE-2026-15743-r1.patch