CachingWebClient shares user responses across users in Eclipse Vert.x
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-200.
Summary
Eclipse Vert.x versions from 4.0.0 through 4.5.35 and from 5.0.0 through 5.2.2 are affected. When one CachingWebClient is shared across users, a user-specific response that is cacheable and not marked private or no-store is stored in the shared cache tier (CWE-524). A later user or an anonymous caller using the same client can receive an earlier user's response, which may disclose authenticated content or a session cookie that enables session fixation or hijacking.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Vert.x | 4.0.0 – 4.5.35; 5.0.0 – 5.2.2 | — | No fix listed | CNA |
- Eclipse Vert.x VendorEclipse Foundation Affected 4.0.0 – 4.5.35; 5.0.0 – 5.2.2 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* | — | — | Eclipse Foundation |
- cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* Versions — — ·Eclipse Foundation
Remediation
The sources list no fixed version for Eclipse Vert.x. Red Hat lists these products as affected with no fix plan available: Exploit Intelligence, OpenShift Serverless, Red Hat Build of Keycloak, Red Hat OpenShift AI (RHOAI), Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, and Red Hat build of Quarkus.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Build of Keycloak | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Red Hat build of Debezium 3 | Affected | No fix yet |
| Red Hat build of Quarkus | Affected | No fix yet |
Not affected: 1 product
- Red Hat OpenShift Dev Spaces
Timeline
- 2026-11-03 Threatist record created from CVE-2026-118489
- 2026-11-03 Alias added: GHSA-c6p9-42vh-5r44
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-03 Priority changed: MEDIUM → LOW
- 2026-11-03 Affected versions changed · Red Hat
- 2026-11-03 CVSS score added · Red Hat
- 2026-11-04 Affected versions changed · Red Hat
References
More Eclipse Foundation vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
- TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
- TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
- TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
- TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-118489 · CVE Program
- CVE-2026-118489 · NVD
- FIRST EPSS
- GHSA-c6p9-42vh-5r44 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-118489 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences