Apache Cocoon cache can leak one user's data to another (CVE-2026-108088)
Original title: CVE-2026-108088: Apache Cocoon: Cross-user cache poisoning
On multi-user apps, cached values for one user can be served to others, and no fix is planned.
Apache disclosed low-severity CVE-2026-108088 in Apache Cocoon, unsupported when assigned. With caching enabled on a multi-user application, one user's cached values can be used when serving content to other users. All versions are affected. The project is retired and Apache says it will not release a fixing version.
- Posted by Arnout Engelen on October 20.
- Apache rates severity low.
- The issue is use of a cache containing sensitive information.
- No fixed release is planned because the project is retired.
Impact: One user's cached content can be served to other users
| Product | Affected |
|---|---|
| Apache Cocoon | all versions |
- 1.Do not expect a patch; Apache says the retired project will not get a fix.
- CVEs
- CVE-2026-108088
- Vendors
- Apache
- Products
- Apache Cocoon
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108088 | ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon | 7.5 | — |
From the original article
Posted by Arnout Engelen on Oct 20 Severity: low Affected versions: - Apache Cocoon: all versions Description: ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.