http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale
Priority MEDIUM 45CWE-524Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 4 fixed, 10 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00596 48th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 4 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Red Hat 4 advisories
- RHSA-2026:92307 Released 2026-10-29 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.13.14 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +16
- RHSA-2026:92303 Released 2026-10-29 · Red Hat rating Importantmulticluster engine for Kubernetes v2.8.12 security update
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9 +12
- RHSA-2026:88198 Released 2026-10-22 · Red Hat rating ImportantRed Hat Developer Hub 1.10.6 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9
Show 1 more Red Hat advisories
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Connectivity Link 1 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 | Fixed | RHSA-2026:92307 |
| Red Hat Developer Hub 1.10 | Fixed | RHSA-2026:88198 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
| multicluster engine for Kubernetes 2.8 | Fixed | RHSA-2026:92303 |
Not affected: 25 products
- Confidential Compute Attestation
- Gatekeeper 3
- Migration Toolkit for Applications 8
- Migration Toolkit for Containers
- Red Hat 3scale API Management Platform 2
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Build of Podman Desktop
- Red Hat Developer Hub 1
- Red Hat Developer Hub 1.10
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces
- Red Hat Openshift Data Foundation 4
- Red Hat Satellite 6
- Red Hat build of Apache Camel for Spring Boot 4
- Self-service automation portal 2
- multicluster engine for Kubernetes 2.8
Timeline
- 2026-10-02 Threatist record created from CVE-2026-93748
- 2026-10-03 Alias added: GHSA-ch52-4w7c-c8xp
- 2026-10-07 Affected versions changed · Red Hat
- 2026-10-07 Affected versions changed · Red Hat
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-15 CISA SSVC decision points changed
- 2026-10-15 Priority changed: HIGH → MEDIUM
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88198 · Red Hat
- 2026-10-23 Fix available: Red Hat Developer Hub 1.10 · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-28 Advisory GHSA-ch52-4w7c-c8xp withdrawn
- 2026-10-30 Fix available: RHSA-2026:92303 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92307 · Red Hat
- 2026-10-30 Fix available: Red Hat Advanced Cluster Management for Kubernetes 2.13, multicluster engine for Kubernetes 2.8 · Red Hat
References
More kornelski vulnerabilities
- TI-2026-63116 http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard CVSS 4.0HIGH 8.2
Sources
- CVE-2026-93748 · CVE Program
- CVE-2026-93748 · NVD
- FIRST EPSS
- GHSA-ch52-4w7c-c8xp · GitHub Advisory Database · CC BY 4.0
- CVE-2026-93748 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences