Live › vulnerability › CVE-2026-118489
When one CachingWebClient is shared across users, a cacheable response meant for one user can be stored in a shared cache and served to other users requesting the same URL. An attacker can read another user's authenticated content or session cookie, which may enable session fixation or hijacking.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Java apps using Vert.x CachingWebClient with one instance shared across users (for example per-user WebClientSession objects over a shared caching client) are exposed. Per the advisory, responses to requests with an Authorization header, and cacheable responses that set cookies, can be stored in the shared cache and replayed to other users or anonymous callers, leaking content or session IDs. Apps that use a client per user, don't use CachingWebClient, or whose origin marks responses private/no-store can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vertx-web-client | maven | >= 4.0.0, <= 4.5.35; >= 5.0.0, <= 5.2.2 | 4.5.36, 5.2.3 |
4.5.36 (4.x line) or 5.2.3 (5.x line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one CachingWebClient is shared across users — the documented pattern of a per-user WebClientSession over a shared caching client — a response that is specific to one user but is cacheable and not marked private/no-store is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.
This page as .md · .json · in your agent: get_signal("CVE-2026-118489")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.