CVE-2026-15743

Name of the Vulnerable Software and Affected Versions Catalyst::Plugin::Static::Simple versions through 0.38

Description The serve static() function always sets the Cache-Control header to "public", which cannot be overridden. This informs proxies that content can be stored in a shared cache and reused for other users, including those making requests with an Authorization header. Additionally, setting the expires time to "0" to disable caching is ignored.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.