{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-03T19:02:22.683","vulnerabilities":[{"cve":{"id":"CVE-2026-118489","sourceIdentifier":"emo@eclipse.org","published":"2026-11-03T15:17:24.780","lastModified":"2026-11-03T16:13:23.003","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking."}],"affected":[{"source":"emo@eclipse.org","affectedData":[{"vendor":"Eclipse Foundation","product":"Eclipse Vert.x","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThanOrEqual":"4.5.35","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThanOrEqual":"5.2.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"emo@eclipse.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"emo@eclipse.org","type":"Primary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-524"}]}],"references":[{"url":"https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3","source":"emo@eclipse.org"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/523","source":"emo@eclipse.org"}]}}]}