GHSA-ch52-4w7c-c8xpPublishedWithdrawn

http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2026-93748

Published

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.

Source published: 18 Sep 2026 17:51:34 UTC
Source modified: 5 Nov 2026 14:40:44 UTC
Observed here: 5 Nov 2026 15:36:24 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

euvd · EUVD-2026-83253

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Sep 18, 2026, 5:51:34 PM

dateUpdated: Oct 14, 2026, 10:56:47 PM

5 related source bulletins · separate from aliases

RHSA-2026:92307: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.14 security update

CVE-2026-14199 · CVE-2026-15815 · CVE-2026-33818 · CVE-2026-37236 · CVE-2026-39834 · CVE-2026-56853 · CVE-2026-56854 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-63209 · CVE-2026-77354 · CVE-2026-77405 · CVE-2026-77411 · CVE-2026-84304 · CVE-2026-84375 · CVE-2026-84445 · CVE-2026-88031 · CVE-2026-93748 · CVE-2026-106445 · CVE-2026-106446

RHSA-2026:88198: Red Hat Security Advisory: Red Hat Developer Hub 1.10.6 release.

CVE-2026-84782 · CVE-2026-90711 · CVE-2026-93748 · CVE-2026-93749 · CVE-2026-101916

WID-SEC-W-2026-4056: Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen

CVE-2026-101898 · CVE-2026-101901 · CVE-2026-101903 · CVE-2026-101905 · CVE-2026-101906 · CVE-2026-101907 · CVE-2026-101909 · CVE-2026-12185 · CVE-2026-12802 · CVE-2026-12860 · CVE-2026-13006 · CVE-2026-13676 · CVE-2026-14682 · CVE-2026-18036 · CVE-2026-19534 · CVE-2026-19693 · CVE-2026-41842 · CVE-2026-41845 · CVE-2026-41850 · CVE-2026-49434 · CVE-2026-50750 · CVE-2026-53404 · CVE-2026-54399 · CVE-2026-54428 · CVE-2026-54512 · CVE-2026-54513 · CVE-2026-55153 · CVE-2026-55831 · CVE-2026-55833 · CVE-2026-56624 · CVE-2026-56745 · CVE-2026-58061 · CVE-2026-58062 · CVE-2026-59641 · CVE-2026-59645 · CVE-2026-59651 · CVE-2026-59903 · CVE-2026-62243 · CVE-2026-65182 · CVE-2026-65183 · CVE-2026-65637 · CVE-2026-65927 · CVE-2026-66422 · CVE-2026-67213 · CVE-2026-67214 · CVE-2026-68494 · CVE-2026-68495 · CVE-2026-68497 · CVE-2026-68498 · CVE-2026-68525 · CVE-2026-68569 · CVE-2026-68763 · CVE-2026-71888 · CVE-2026-71889 · CVE-2026-71891 · CVE-2026-73086 · CVE-2026-73507 · CVE-2026-73508 · CVE-2026-73634 · CVE-2026-73635 · CVE-2026-73646 · CVE-2026-75140 · CVE-2026-75595 · CVE-2026-75596 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-77185 · CVE-2026-84292 · CVE-2026-84375 · CVE-2026-93488 · CVE-2026-93491 · CVE-2026-93558 · CVE-2026-93690 · CVE-2026-93748 · CVE-2026-93994

RHSA-2026:92303: Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.12 security update

CVE-2026-33818 · CVE-2026-39822 · CVE-2026-39834 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-63209 · CVE-2026-84304 · CVE-2026-93748 · CVE-2026-106445 · CVE-2026-106446

msrc_CVE-2026-93748: http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale

CVE-2026-93748

Source published: Sep 18, 2026, 5:51:34 PM (timezone not stated)
Source modified: Oct 14, 2026, 10:56:47 PM (timezone not stated)
Observed here: 5 Nov 2026 14:41:50 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

nvd · CVE-2026-93748

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-524

Original publisher date fields

published: 2026-09-18T18:18:33.330

lastModified: 2026-11-05T15:17:27.427

Source published: 18 Sep 2026 18:18:33 UTC
Source modified: 5 Nov 2026 15:17:27 UTC
Observed here: 6 Nov 2026 21:03:40 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

osv · GHSA-ch52-4w7c-c8xp

Withdrawn

### Withdrawn Advisory This advisory has been withdrawn because it's not a valid vulnerability. This link is maintained to preserve external references. ### Original Description http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.

Source published: 18 Sep 2026 18:31:44 UTC
Source modified: 28 Oct 2026 21:30:03 UTC
Observed here: 28 Oct 2026 21:55:29 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Publisher rating · HIGH