CVE Feed

    Dashboard / CVE / CVE-2026-93750

    CVE-2026-93750

    http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients.

    Published:Sep 18, 2026
    Last Modified:Sep 21, 2026
    EPS:Sep 18, 2026
    EPSS Score:0.0035
    CVSS Score:5.9

    Affected Products

    Vendor
    Http-cache-semantics Project
    Product
    Http-cache-semantics
    Vendor
    Kornelski
    Product
    Http-cache-semantics

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-436 Interpretation Conflict

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High