---
id: CVE-2026-118489
title: >-
  CachingWebClient shares user-specific HTTP responses across users via the
  shared cache tier
summary: "In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one\_`CachingWebClient`\_is shared across users — the documented pattern of a per-user\_`WebClientSession`\_over a shared caching client — a response that is specific to one us…"
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
  - CWE-524
vendor: Eclipse Foundation
product: Eclipse Vert.x
affected:
  - eclipse_vert.x >= 4.0.0 <= 4.5.35
  - eclipse_vert.x >= 5.0.0 <= 5.2.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-03T18:09:07.920897Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:09:32.017Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118489'
references:
  - url: >-
      https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/523'
tags:
  - cve.org
epss: 0.00342
epssPercentile: 0.27858
ingestedAt: '2026-11-05T20:33:06.339Z'
---

## Overview

In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.

## Affected

- `eclipse_vert.x >= 4.0.0 <= 4.5.35`
- `eclipse_vert.x >= 5.0.0 <= 5.2.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.