CVE-2026-93748 http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale
Attackers can retrieve other users' cached session cookies by exploiting improper validation of max-stale directives in the http-cache-semantics library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93748?
CVE-2026-93748 is a high-severity vulnerability in kornelski http-cache-semantics, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
Weakness: CWE-524
Which versions are affected by CVE-2026-93748?
How do I fix CVE-2026-93748?
Upgrade to a fixed version.
Is CVE-2026-93748 being exploited?
There is no known exploitation of CVE-2026-93748 in the wild and no public exploit code.
Sources
Also known as AZL-103448, AZL-103485, CLEANSTART-2026-JV93076, CLEANSTART-2026-UD09279, CLEANSTART-2026-YQ53384, CLSA-2026-1792231034 and 22 more.