Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7c46481544 advisory.

    Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static     asset served. Consequently, intermediaries such as shared reverse proxies or CDN edge caches may store and     later serve content that was intended to be private, thereby exposing sensitive data to unintended     recipients.

    In this package, the plugin's code is changed to allow the Cache-Control header to be overridden and the     Expires header to be set to 0.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4d5a716383 advisory.

    Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static     asset served. Consequently, intermediaries such as shared reverse proxies or CDN edge caches may store and     later serve content that was intended to be private, thereby exposing sensitive data to unintended     recipients.

    In this package, the plugin's code is changed to allow the Cache-Control header to be overridden and the     Expires header to be set to 0.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2d96cf2594 advisory.

    Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static     asset served. Consequently, intermediaries such as shared reverse proxies or CDN edge caches may store and     later serve content that was intended to be private, thereby exposing sensitive data to unintended     recipients.

    In this package, the plugin's code is changed to allow the Cache-Control header to be overridden and the     Expires header to be set to 0.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The
    _serve_static method always sets the Cache-Control header to public, with no means of overriding it.
    This advises proxies that the content may be stored in a shared cache, and may be reused in responses to     requests from other users. (This includes requests with an Authorization header.) Configuring the expires     time to 0 to disable caching, as documented, is ignored. (CVE-2026-15743)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350998	Fedora 43 : perl-Catalyst-Plugin-Static-Simple (2026-7c46481544)	Nessus	Fedora Local Security Checks	Local	medium
350987	Fedora 45 : perl-Catalyst-Plugin-Static-Simple (2026-4d5a716383)	Nessus	Fedora Local Security Checks	Local	medium
350967	Fedora 44 : perl-Catalyst-Plugin-Static-Simple (2026-2d96cf2594)	Nessus	Fedora Local Security Checks	Local	medium
338449	Linux Distros Unpatched Vulnerability : CVE-2026-15743	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-15743

medium

Tenable Plugins

medium

medium

medium

medium