Bug 2538846 (CVE-2026-93750)
| Summary: | CVE-2026-93750 http-cache-semantics: http-cache-semantics: Information disclosure via improper Vary header wildcard validation | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abarbaro, abrianik, abuckta, akhatavk, alizardo, anthomas, anujha, aos-team-art-private, aschwart, asdas, asoldano, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, boliveir, bstansbe, cdrage, csuconic, dbruscin, dfreiber, dkuc, dlofthou, dpaolell, drichtar, drow, dschmidt, dymurray, ehelms, ehugonne, fmariani, gbenhaim, ggainey, ggrzybek, gmalinko, gparvin, gtanzill, gtully, ibolton, ikhan, istudens, ivassile, iweiss, janstey, jbalunas, jburrell, jbuscemi, jchui, jdelft, jhe, jlanda, jmatthew, jmontleo, jpasqual, jraez, jsherman, jupierce, juwatts, jwon, kaycoth, kshier, ktsao, kvanderr, lchilton, lgarciaa, mbiarnes, mcarlett, mdellweg, mhulan, mosmerov, mposolda, mstipich, msvehla, nboldt, niyer, nmoumoul, nwallace, oaljalju, orabin, osousa, parichar, pberan, pcreech, pdelbell, pesilva, pgaikwad, pjindal, pmackay, ppalepu, ppostler, prdhamdh, psrna, rbobbitt, rchan, rekumar, rexwhite, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rmartinc, rstancel, rstepani, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, sseago, ssilvert, stcannon, sthirugn, sthorger, suppawar, tasato, tbish, tcunning, thjenkin, tlavocat, tmalecek, tsze, twaugh, vdosoudi, vkumar, vlaad, vmuzikar, vvoronko, watson-tool-maintainers, yfang, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in http-cache-semantics. This vulnerability allows a remote attacker to disclose sensitive information across clients. The _varyMatches() function fails to properly validate Vary header wildcards, enabling an attacker to request URLs previously fetched by other clients and receive cached responses intended for different users. This leads to unauthorized information disclosure.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-09-22 20:53:30 UTC
|