Bug 2538111 (CVE-2026-93748)

Summary: CVE-2026-93748 http-cache-semantics: http-cache-semantics: Information Disclosure via max-stale directive
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abarbaro, abrianik, abuckta, akhatavk, akostadi, alizardo, amasferr, anthomas, anujha, aos-team-art-private, aschwart, asdas, asoldano, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, boliveir, bstansbe, cdrage, csuconic, dbruscin, dfreiber, dkuc, dlofthou, dmayorov, dpaolell, drichtar, drow, dschmidt, dymurray, ehelms, ehugonne, fmariani, gbenhaim, ggainey, ggrzybek, gmalinko, gparvin, gtanzill, gtully, ibolton, istudens, ivassile, iweiss, janstey, jbalunas, jburrell, jbuscemi, jchui, jdelft, jhe, jlanda, jlledo, jmatthew, jmontleo, jpasqual, jraez, jsherman, jupierce, juwatts, jwon, kaycoth, kshier, ktsao, kvanderr, lchilton, lgarciaa, mbiarnes, mcarlett, mdellweg, mhulan, mosmerov, mposolda, mstipich, msvehla, nboldt, niyer, nmoumoul, nwallace, oaljalju, orabin, osousa, pantinor, parichar, pberan, pcreech, pdelbell, pesilva, pgaikwad, pjindal, pmackay, ppalepu, ppostler, prdhamdh, psrna, rbobbitt, rchan, rekumar, rexwhite, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rmartinc, rstancel, rstepani, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, sseago, ssilvert, stcannon, sthirugn, sthorger, suppawar, tasato, tbish, tcunning, thjenkin, tlavocat, tmalecek, tsedmik, tsze, twaugh, vdosoudi, vkumar, vlaad, vmuzikar, vvoronko, watson-tool-maintainers, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in http-cache-semantics. This vulnerability allows unauthenticated attackers to retrieve cached responses, including sensitive session credentials like Set-Cookie values, belonging to other users. This occurs because the component fails to properly validate security-zeroed cache entries when processing client `max-stale` directives. By requesting the same URL with a large `max-stale` value, an attacker can obtain another user's session credentials from shared-cache entries that were intended to be secure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2544554, 2544557, 2544567, 2544569, 2544572, 2544555, 2544556, 2544559, 2544562, 2544563, 2544565, 2544570, 2544571, 2544574    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-22 17:08:51 UTC 
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.