Cache Information Leak in Apache Cocoon by Apache

CVE-2026-108088

What is CVE-2026-108088?

A vulnerability exists in Apache Cocoon where cached values from a multi-user application can expose sensitive information across multiple users. In scenarios where caching is employed, the application may inadvertently serve personalized data intended for one user to another, leading to potential data breaches. This vulnerability affects all versions of Apache Cocoon, which is no longer actively maintained. Users are strongly encouraged to seek alternative solutions or to limit access to the application to trusted users only.

References