CVE-2026-93748
http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale
Published Sep 18, 2026 · updated Oct 14, 2026 · kornelski http-cache-semantics
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Sep 18, 2026 · NIST NVD
Detected
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zero
Oct 14, 2026 · NIST NVD
Updated
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zero
Affected
- vendor kornelski http-cache-semanticsversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-93748
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-s
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-93748
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-93748
30-day exploitation probability 0.6%
first.org - NIST NVDVulnerability recordCVE-2026-93748
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-s
nvd.nist.gov