Michael Nelson

The issue allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers, due to the improper inclusion of the `Vary: Cookie` or `Cache-Control` header in responses.