---
id: "CVE-2026-118489"
kind: "vulnerability"
aliases: ["CVE-2026-118489"]
title: "Eclipse Vert.x: shared web client cache leaks one user's responses to others"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "vertx-web-client", "fixed": ["4.5.36", "5.2.3"], "affected": ">= 4.0.0, <= 4.5.35; >= 5.0.0, <= 5.2.2", "ecosystem": "maven"}]
ecosystems: []
tags: ["caching", "java", "package", "vert.x", "web-client"]
not_affected_if: ["no-caching", "per-user-client", "private-responses"]
published_at: "2026-11-03T15:17:24+00:00"
first_seen_at: "2026-11-03T15:21:56+00:00"
updated_at: "2026-11-03T15:26:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118489", "first_seen_at": "2026-11-03T15:21:56+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T15:26:16+00:00"}]
---

# Eclipse Vert.x: shared web client cache leaks one user's responses to others

When one CachingWebClient is shared across users, a cacheable response meant for one user can be stored in a shared cache and served to other users requesting the same URL. An attacker can read another user's authenticated content or session cookie, which may enable session fixation or hijacking.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:vertx-web-client affected >= 4.0.0, <= 4.5.35; >= 5.0.0, <= 5.2.2 fixed 4.5.36, 5.2.3

## How to check

- Search code for CachingWebClient and check whether one instance is shared across users, e.g. per-user WebClientSession objects over a shared caching client.
- Check the io.vertx:vertx-web-client version in Maven or Gradle. Affected: 4.0.0 to 4.5.35 and 5.0.0 to 5.2.2.
- Also check whether your upstream responses to Authorization-bearing requests or Set-Cookie responses lack Cache-Control private or no-store.

## Fix

Upgrade io.vertx:vertx-web-client to 4.5.36 (4.x line) or 5.2.3 (5.x line). The advisory lists no workaround; until upgraded, use a separate client per user or make sure origin responses carry Cache-Control: private or no-store.

## Timeline

- 2026-11-03T15:21:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118489
- 2026-11-03T15:26:16+00:00 analyst — Read GHSA-xh2g-9hw9-mvp3 via WebFetch: affected 4.0.0-4.5.35 and 5.0.0-5.2.2, fixed 4.5.36 and 5.2.3; no workaround listed (my interim advice is mine, not the vendor's). No exploitation or PoC seen; did not search social.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3

## From the sources

In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_