Live › vulnerability › CVE-2026-108088
Go to dashboardWhen Apache Cocoon's cache is used in a multi-user application, cached values for one user can be served to other users. An attacker may therefore see content that was generated for someone else.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache Cocoon with its cache enabled in an application that serves multiple users. Single-user deployments, or instances restricted to fully trusted users, are much less exposed. The sources do not say which cache settings are involved beyond the multi-user condition.
No product ranges from the sources yet.
pom.xml for cocoon.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users.
This issue affects Apache Cocoon: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
This page as .md · .json · in your agent: get_signal("CVE-2026-108088")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.