# CVE-2026-15743: Catalyst::Plugin::Static::Simple improper cache control in static file serving

Source: https://junglewise.ai/threats/cve-2026-15743-catalyst-plugin-static-simple-improper-cache-control-in-static  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-15743 · Severity: medium · CVSS 5.7 · Published 2026-08-20

Catalyst::Plugin::Static::Simple is a Perl web framework module that serves static files to web applications. The module incorrectly marks all responses as publicly cacheable, allowing HTTP proxies and shared caches to store and reuse responses—including those protected by authentication headers—to other users. This can expose sensitive files meant only for authenticated users to unauthorized parties.

Vendors: [Perl](https://junglewise.ai/threats/vendors/perl).

## Quick answers

**Is CVE-2026-15743 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15743 being exploited in the wild.

**How severe is CVE-2026-15743?** Medium severity, with a CVSS score of 5.7, published 20 August 2026.

**Which products and versions are affected?** Perl Catalyst::Plugin::Static::Simple through 0.38.

**Is there a fix for CVE-2026-15743?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15743 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15743?** Check whether you run Perl Catalyst::Plugin::Static::Simple at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cache control configuration bypass in the _serve_static method. The module unconditionally sets the Cache-Control header to "public", overriding HTTP caching semantics and signaling to intermediary proxies that responses may be stored in shared caches and reused. Additionally, the documented workaround of setting expires to "0" to disable caching is ignored, leaving no way for developers to prevent public caching of sensitive static files. An attacker or passive observer positioned on a network path with access to shared caches (common in CDNs, ISPs, and corporate proxies) can retrieve cached responses that were originally served only to authenticated users. No authentication or special network access is required beyond existing proxy positioning; the vulnerability is triggered automatically when responses are served.

## Affected products

- Perl Catalyst::Plugin::Static::Simple through 0.38

## Timeline

- 2026-08-20: disclosed
- other: CVE-2026-15743 assigned

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://datatracker.ietf.org/doc/html/rfc9111](https://datatracker.ietf.org/doc/html/rfc9111)