CVE-2026-118489 CachingWebClient shares user-specific HTTP responses across users via the shared cache tier

In Eclipse Vert.x versions 4.0.0,4.5.35 or 5.0.0,5.2.2, when one CachingWebClient is shared across users — the documented pattern of a per-user WebClientSession over a shared caching client — a response that is specific to one user but is cacheable and not marked private/no-store is stored in the...

CVE-2026-118489 CachingWebClient shares user-specific HTTP responses across users via the shared cache tier

In Eclipse Vert.x versions 4.0.0,4.5.35 or 5.0.0,5.2.2, when one CachingWebClient is shared across users — the documented pattern of a per-user WebClientSession over a shared caching client — a response that is specific to one user but is cacheable and not marked private/no-store is stored in the...

CVE-2026-118489

Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2] are vulnerable to a cache poisoning issue in the CachingWebClient component. When a shared caching client is used with per-user WebClientSession objects, responses specific to one user that are cacheable and lack private or no-store markers ...