libcatalyst-plugin-static-simple-perl - Debian Package Tracker

1 security issue in forky high

1 important issue:

CVE-2026-15743: Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.

Created: 2026-08-20 Last update: 2026-08-23 01:01

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2026-15743: Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.

Created: 2026-08-20 Last update: 2026-08-23 01:01

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-15743: Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.

Created: 2026-08-20 Last update: 2026-08-23 01:01

1 low-priority security issue in trixie low

1 issue left for the package maintainer to handle:

CVE-2026-15743: (needs triaging) Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-08-20 Last update: 2026-08-23 01:01

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 0.38-1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-08-21 Last update: 2026-08-21 06:18