CVE-2026-118489

    Dashboard / Vulnerabilities / CVE-2026-118489

    CVE-2026-118489

    Published: 3 Nov 2026Last Modified: 5 Nov 2026

    Summary: CachingWebClient shares user-specific HTTP responses across users via the shared cache tier

    Details: In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.

    References: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/523, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118489.json, https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3, https://nvd.nist.gov/vuln/detail/CVE-2026-118489

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 7553ecb4e6bbe2888dd20e81675f662df26645b5
    Fixed -None

    Affected versions

    5.2.2
    5.2.1
    5.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118489 | CVE-DB