{"id":"EUVD-2026-83253","enisaUuid":"f102c9c0-46cf-38a9-a29b-830f7078ccf3","description":"http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user\u0027s Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.","datePublished":"Sep 18, 2026, 5:51:34 PM","dateUpdated":"Oct 14, 2026, 10:56:47 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/kornelski/http-cache-semantics/issues/56\nhttps://github.com/kornelski/http-cache-semantics\nhttps://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441\nhttps://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623\nhttps://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale\n","aliases":"CVE-2026-93748\nGHSA-ch52-4w7c-c8xp\n","assigner":"VulnCheck","epss":0.57,"enisaIdProduct":[{"id":"590bb227-c5a7-3876-9138-61a5e7761fbd","product":{"name":"http-cache-semantics","vendor":{"name":"n/a"}},"product_version":"0 ≤4.2.0"}],"enisaIdVendor":[{"id":"7dc9d7b3-03b8-3eed-b4f0-16d12fff36ad","vendor":{"name":"kornelski"}}],"enisaIdVulnerability":[{"id":"aa54f5f0-1b22-36af-acaf-a8449ed7957c","vulnerability":{"id":"CVE-2026-93748","description":"http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user\u0027s Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.","datePublished":"Sep 18, 2026, 5:51:34 PM","dateUpdated":"Oct 14, 2026, 10:56:47 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/kornelski/http-cache-semantics/issues/56\nhttps://github.com/kornelski/http-cache-semantics\nhttps://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441\nhttps://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623\nhttps://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale\n","enisa_id":"EUVD-2026-83253\n","assigner":"VulnCheck","epss":0.57,"dataProcessed":"Oct 30, 2026, 7:20:15 AM","vulnerabilityProduct":[{"id":"d7caac10-f33a-3877-80ea-933f12afd815","product":{"name":"http-cache-semantics","vendor":{"name":"n/a"}},"product_version":"0 ≤4.2.0"}],"vulnerabilityVendor":[{"id":"307dbfe7-fe78-38f9-bc4a-f062009cfbc4","vendor":{"name":"kornelski"}}]}},{"id":"f1267876-39dd-35ff-bc6f-55552406cd00","vulnerability":{"id":"GHSA-ch52-4w7c-c8xp","description":"Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses","datePublished":"Sep 18, 2026, 6:31:44 PM","dateUpdated":"Oct 28, 2026, 9:13:39 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-93748\nhttps://github.com/kornelski/http-cache-semantics/issues/56\nhttps://github.com/kornelski/http-cache-semantics/issues/56#issuecomment-5975759591\nhttps://github.com/kornelski/http-cache-semantics\nhttps://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441\nhttps://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623\nhttps://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale\n","enisa_id":"EUVD-2026-83253\n","aliases":"CVE-2026-93748\nGHSA-ch52-4w7c-c8xp\n","epss":0.0,"dataProcessed":"Oct 30, 2026, 2:02:51 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"9206c69e-4a58-354f-bd32-edf051347515","advisory":{"id":"RHSA-2026:88198","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.6 release.","summary":"Red Hat Developer Hub 1.10.6 has been released.","datePublished":"Oct 22, 2026, 12:08:53 PM","dateUpdated":"Oct 30, 2026, 1:18:19 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:88198\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88198.json\n","aliases":"CVE-2026-84782\nCVE-2026-90711\nCVE-2026-93748\nCVE-2026-93749\nCVE-2026-101916\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"15f55afc-997d-3497-b68f-72d62fa21d28","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:af3e701e154cb3229f68b47f8c5d99b671a14271e974bab8d3fa5116b84c149d_amd64","vendor":{"name":"Red Hat"}}},{"id":"19c9893f-6c58-3806-97e0-698741ed1698","product":{"name":"registry.redhat.io/rhdh/rhdh-must-gather-rhel9@sha256:d7e468fbf452fe26aa11bfc7fe4349b65af7697b7a98377d24b1cef2fc556271_amd64","vendor":{"name":"Red Hat"}}},{"id":"27dd5e10-50b0-3dcf-9cc2-a5e857b9c3d6","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:ba81baa22c5c75c71e361e15ec6b24194981edfd6cc5a3958c28eb6c7581b614_amd64","vendor":{"name":"Red Hat"}}},{"id":"33c9c75c-21b0-3f59-bfd6-8b5bb3dd4f99","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:2c29c29906130c4a194b623e5e3ac7efa2a454d265d32e21a9f255078edb1a81_amd64","vendor":{"name":"Red Hat"}}},{"id":"4539c399-9d86-38e8-b062-42dbe4a2fa43","product":{"name":"registry.redhat.io/rhdh/rhdh-rag-content-rhel9@sha256:e2e8f2254b15901709a11c8b665829ea3725bb973fa15c83f54dac7aa8cf4138_amd64","vendor":{"name":"Red Hat"}}},{"id":"9213d803-a20d-3c63-8a00-b9ed3bc6bdc6","product":{"name":"Red Hat Developer Hub 1.10","vendor":{"name":"Red Hat"}}}]}},{"id":"f12fd673-cd9d-3f54-a878-8496fc638121","advisory":{"id":"msrc_CVE-2026-93748","description":"http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale","datePublished":"Sep 25, 2026, 1:05:13 AM","dateUpdated":"Sep 29, 2026, 1:55:02 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-93748.json\n","aliases":"CVE-2026-93748\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"147b2921-9fe9-3a2b-863a-20dac251b51d","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"2d4320a3-4e6a-3fc8-85e0-7527279a9e22","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"5edcb6b9-72da-3bfe-8a52-ad1b90748d90","product":{"name":"azl3 python-tensorboard 0:2.16.2-6.azl3","vendor":{"name":"Microsoft"}}},{"id":"db8a3c48-4def-30f6-96f9-8af07a31c4eb","product":{"name":"python-tensorboard","vendor":{"name":"Microsoft"}}}]}}]}