{"affected":[{"defaultStatus":"unaffected","product":"Eclipse Vert.x","source":"CNA: eclipse","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"4.5.35","status":"affected","version":"4.0.0","versionType":"semver"},{"lessThanOrEqual":"5.2.2","status":"affected","version":"5.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-118489","cwes":["CWE-200","CWE-524"],"description":"In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: eclipse","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793717748515,"publishedAt":1793717748515,"references":[{"source":"CNA: eclipse","tags":[],"url":"https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3"},{"source":"CNA: eclipse","tags":[],"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/523"}],"remediation":[],"revision":"9a492660a06b3837ee3a8374f9ba46e99fb0677d3e84deede8c537ad8fc8b817","sources":[{"modifiedAt":1793717748515,"name":"CNA: eclipse","retrievedAt":1793718523675,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118489"}],"ssvc":null,"status":"published","title":"CachingWebClient shares user-specific HTTP responses across users via the shared cache tier","updatedAt":1793718523675}