CVE-2026-118489

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.35 Eclipse Vert.x versions 5.0.0 through 5.2.2

Description An issue exists when a CachingWebClient is shared across multiple users. If a response specific to one user is cacheable and lacks private or no-store markers, it is stored in the shared client-level cache. Consequently, subsequent users or anonymous callers requesting the same URL may receive the cached response of a previous user. This can lead to the disclosure of authenticated content or session cookies, potentially enabling session hijacking or session fixation.

Recommendations Update Eclipse Vert.x versions 4.0.0 through 4.5.35 to a version newer than 4.5.35. Update Eclipse Vert.x versions 5.0.0 through 5.2.2 to a version newer than 5.2.2.