Vulnerability in Kornelski Http-Cache-Semantics
CVE-2026-93748
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.006 (47.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 47.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.006 · change: +0.000
Affected products
Weakness classification (CWE)
References
- github.com/kornelski/http-cache-semantics/issues/56 (issue-tracking)
- github.com/kornelski/http-cache-semantics (product)
- github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e… (technical-description)
- github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e… (technical-description)
- www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cach… (third-party-advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2026-93748?
- CVE-2026-93748 is a high-severity vulnerability in Kornelski Http-Cache-Semantics, classified under Use of Cache Containing Sensitive Information. CVSS score: 7.5/10. Published 2026-09-18.
- How severe is CVE-2026-93748?
- High severity. CVSS v3 base score is 7.5 out of 10.