Caching Issue in Eclipse Vert.x Web Client Affects User Privacy

CVE-2026-118489

What is CVE-2026-118489?

In certain versions of Eclipse Vert.x, a vulnerability exists when a shared CachingWebClient is used across multiple user sessions. This configuration may inadvertently store responses meant for one user in the shared cache, potentially serving that user-specific response to others. Responses not properly marked as private or no-store can expose sensitive information such as authenticated session content or session cookies. This situation creates risks of session fixation or hijacking, endangering user privacy and security.

References