{"id":"CVE-2026-118489","kind":"vulnerability","aliases":["CVE-2026-118489"],"related":[],"title":"Eclipse Vert.x: shared web client cache leaks one user's responses to others","description":"In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.","summary":"When one CachingWebClient is shared across users, a cacheable response meant for one user can be stored in a shared cache and served to other users requesting the same URL. An attacker can read another user's authenticated content or session cookie, which may enable session fixation or hijacking.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vertx-web-client","fixed":["4.5.36","5.2.3"],"affected":">= 4.0.0, <= 4.5.35; >= 5.0.0, <= 5.2.2","ecosystem":"maven"}],"ecosystems":[],"tags":["caching","java","package","vert.x","web-client"],"not_affected_if":["no-caching","per-user-client","private-responses"],"how_to_check":"- Search code for CachingWebClient and check whether one instance is shared across users, e.g. per-user WebClientSession objects over a shared caching client.\n- Check the io.vertx:vertx-web-client version in Maven or Gradle. Affected: 4.0.0 to 4.5.35 and 5.0.0 to 5.2.2.\n- Also check whether your upstream responses to Authorization-bearing requests or Set-Cookie responses lack Cache-Control private or no-store.","fix":"Upgrade io.vertx:vertx-web-client to 4.5.36 (4.x line) or 5.2.3 (5.x line). The advisory lists no workaround; until upgraded, use a separate client per user or make sure origin responses carry Cache-Control: private or no-store.","status":"open","published_at":"2026-11-03T15:17:24+00:00","first_seen_at":"2026-11-03T15:21:56+00:00","triaged_at":"2026-11-03T15:22:53+00:00","updated_at":"2026-11-03T15:26:16+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-03T15:22:53Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Vert.x version outside the affected ranges: `4.5.36` or later on the 4.x line, or `5.2.3` or later on the 5.x line, per the NVD range (versions [4.0.0,4.5.35] or [5.0.0,5.2.2] are affected).\n- Exact fixed-version numbers are inferred from the range boundaries; unknown whether the vendor advisory states them.","reach":"internet","title":"Eclipse Vert.x: shared web client cache leaks one user's responses to others","impact":"high","summary":"When one CachingWebClient is shared across users, a cacheable response meant for one user can be stored in a shared cache and served to other users requesting the same URL. An attacker can read another user's authenticated content or session cookie, which may enable session fixation or hijacking.","audience":"developers","category":"package","nicknames":[],"who_cares":["vert.x","java","web-client","caching"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Other users receive cached responses, exposing sessions or private content","analyst_note":"Confirm the fixed version numbers and any workaround in the Vert.x vendor advisory (github.com linked in the sources).","how_to_check":"- Look for `CachingWebClient` in code and check whether one instance is reused across users or sessions, for example as a shared client with per-user `WebClientSession` objects.\n- Check the Vert.x version in the build file (for example Maven `vertx-web-client` or Gradle dependency) against the affected ranges.","plain_action":"","needs_analyst":true,"not_affected_if":["per-user-client","no-caching","private-responses"],"who_is_affected":"Applications that use Eclipse Vert.x's CachingWebClient with a single client instance shared across users, with per-user WebClientSession objects on top, are exposed. Responses that are user-specific but do not carry private or no-store cache headers are the risk. Apps that create a client per user, or do not cache responses, can likely skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000789,"input_tokens":4268,"output_tokens":725,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version numbers and any workaround in the Vert.x vendor advisory (github.com linked in the sources).","search":"'-118489':16A,19A '-2026':15A,18A '4.0.0':84C '4.5.35':85C '5.0.0':87C '5.2.2':88C 'across':36B,94C 'anonym':154C 'anoth':65B 'attack':62B 'authent':68B,173C 'cach':6A,24B,51B,108C,136C 'cacheabl':39B,120C 'cachingwebcli':33B,91C 'caller':155C 'client':5A,23A,30B,109C,133C,159C 'client-level':132C 'content':69B,174C 'cooki':72B,178C 'cve':14A,17A 'depend':167C 'disclos':172C 'document':97C 'earlier':163C 'eclips':1A,81C 'enabl':75B,181C 'fixat':77B,183C 'hijack':79B,185C 'java':25B 'later':148C 'latter':180C 'leak':7A 'level':134C 'mark':123C 'may':74B 'meant':41B 'no-stor':125C 'one':8A,32B,43B,90C,116C 'other':13A 'packag':26B 'pattern':98C 'per':102C 'per-us':101C 'privat':124C 'read':64B 'receiv':161C 'request':57B,143C 'respons':11A,40B,111C,166C,170C 'serv':53B,139C 'session':71B,76B,151C,177C,182C 'share':3A,35B,50B,93C,107C,135C 'specif':114C 'store':47B,127C,129C 'tier':137C 'url':60B,146C 'user':9A,37B,44B,56B,66B,95C,103C,117C,142C,149C,164C 'version':83C 'vert.x':2A,27B,82C 'vertx':21A 'vertx-web-client':20A 'web':4A,22A,29B 'web-client':28B 'webclientsess':104C","nicknames":[],"mitigations":[],"who_affected":"Java apps using Vert.x CachingWebClient with one instance shared across users (for example per-user WebClientSession objects over a shared caching client) are exposed. Per the advisory, responses to requests with an Authorization header, and cacheable responses that set cookies, can be stored in the shared cache and replayed to other users or anonymous callers, leaking content or session IDs. Apps that use a client per user, don't use CachingWebClient, or whose origin marks responses private/no-store can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T15:26:16Z","by":"analyst","doc":"https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3","run_id":1499},"products":{"at":"2026-11-03T15:26:16Z","by":"analyst","doc":"https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3","run_id":1499},"how_to_check":{"at":"2026-11-03T15:26:16Z","by":"analyst","doc":"https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3","run_id":1499},"who_affected":{"at":"2026-11-03T15:26:16Z","by":"analyst","doc":"https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3","run_id":1499}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["vertxwebclient"],"ptokens":["client","vertx","web"],"labels":["caching","high","java","package","vertx","webclient"],"first_public_at":"2026-11-03T10:01:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118489","severity":null,"published_at":"2026-11-03T15:17:24+00:00","modified_at":"2026-11-03T15:17:24+00:00","first_seen_at":"2026-11-03T15:21:56+00:00","fetched_at":"2026-11-03T15:21:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118489:1499","url":null,"severity":null,"published_at":"2026-11-03T15:26:16+00:00","modified_at":"2026-11-03T15:26:16+00:00","first_seen_at":"2026-11-03T15:26:16+00:00","fetched_at":"2026-11-03T15:26:16+00:00","note":"Read GHSA-xh2g-9hw9-mvp3 via WebFetch: affected 4.0.0-4.5.35 and 5.0.0-5.2.2, fixed 4.5.36 and 5.2.3; no workaround listed (my interim advice is mine, not the vendor's). No exploitation or PoC seen; did not search social."}],"documents":[{"id":58294,"url":"https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T10:01:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}