CVE-2026-108088CWE-524

CVE-2026-108088

published October 20, 2026

CVSS
—
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users.

This issue affects Apache Cocoon: all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00240 · 14.3th percentile
Weakness
CWE-524 · Use of Cache Containing Sensitive Information
Published
2026-10-20T15:17Z
References (2)
https://lists.apache.org/thread/30vg3mht5vsm9vsmrdnx80zp5fw536st · [email protected]http://www.openwall.com/lists/oss-security/2026/10/20/4 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 22 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 20 OCT 10:25Z
    Apache Cocoon: Cross-user cache poisoning
    cvelistv5
  • 20 OCT 10:25Z
    Apache Cocoon: Cross-user cache poisoning
    cvelistv5