CVE-2026-93748

A flaw was found in http-cache-semantics. This vulnerability allows unauthenticated attackers to retrieve cached responses, including sensitive session credentials like Set-Cookie values, belonging to other users. This occurs because the component fails to properly validate security-zeroed cache entries when processing client max-stale directives. By requesting the same URL with a large max-stale value, an attacker can obtain another user's session credentials from shared-cache entries that were intended to be secure.

This vulnerability is rated as having Important severity for Red Hat products because remote, unauthenticated attackers can bypass shared-cache security controls over the network and expose sensitive session credentials belonging to other users. Red Hat products vendoring this library in client-only command-line tools or local development utilities are at reduced risk, as triggering the defect depends on an intermediary or shared cache mechanism processing client cache-control directives. Environments hosting multi-tenant web applications or reverse proxies that evaluate HTTP cache headers via this component face direct exposure to cross-session credential disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.