How severe is CVE-2026-15743?

CVE-2026-15743 has a CVSS 3.x base score of 5.7, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-15743 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-15743?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-15743 published?

CVE-2026-15743 was published on 2026-08-20 and last updated on 2026-08-28.

CVE-2026-15743

CVE-2026-15743 is a medium-severity vulnerability with a CVSS 3.x base score of 5.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-524.

Key facts

Severity: Medium (CVSS 3.x base score 5.7)
EPSS exploit prediction: 0% (23rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-524
Published: 2026-08-20
Last modified: 2026-08-28

Description

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.

Frequently asked questions

What is CVE-2026-15743?: Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused in responses to requests from other users. (This includes requests with an Authorization header.) Configuring the expires time to "0" to disable caching, as documented, is ignored.
How severe is CVE-2026-15743?: CVE-2026-15743 has a CVSS 3.x base score of 5.7, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-15743 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-15743?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-15743 published?: CVE-2026-15743 was published on 2026-08-20 and last updated on 2026-08-28.

References

Other CWE-524 vulnerabilities

CVE-2026-53943 — Critical (CVSS 9.6): Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that…
CVE-2026-19202 — Critical (CVSS 9.1): A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be…
CVE-2025-64762 — Critical (CVSS 9.1): The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS &…
CVE-2026-61836 — High (CVSS 8.6): Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching…
CVE-2026-93748 — High (CVSS 7.5): http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client…
CVE-2026-71316 — High (CVSS 7.5): Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries…

Browse all CWE-524 vulnerabilities →