http-cache-semantics CVE-2026-93748

Exploitation requires that http-cache-semantics (through 4.2.0) be used to drive a SHARED cache that has stored a response containing sensitive per-user data such as a Set-Cookie session credential, where that entry was deliberately 'security-zeroed' by the library. The attacker then re-requests the identical URL supplying a large Cache-Control: max-stale directive, whose mishandling causes the zeroed entry to be served instead of suppressed. Limiting factors: no impact on private/per-user caches or deployments that never cache authenticated responses; the vulnerable path is entirely dependent on the downstream application's shared-cache configuration, so it is not exploitable against the library in isolation despite the PR:N/AC:L vector.

The vendor CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H, all other impacts N) frames this as a high-severity, network-reachable, unauthenticated confidentiality-only flaw - consistent with CWE-524 (Use of Cache Containing Sensitive Information). No EPSS score, no CISA KEV listing, and no explicit public exploit code are present in the provided data; VulnCheck (the reporter) published an advisory and a GitHub issue (#56) documenting the mechanism, but that is analysis, not confirmed weaponization. The realistic risk is materially GATED by a deployment precondition the CVSS vector does not capture: http-cache-semantics is a policy-computation library, not a cache store, so cross-user Set-Cookie disclosure only materializes when a downstream consumer uses it to drive a SHARED cache that actually retains authenticated/credential-bearing responses. Where that condition holds (a shared HTTP cache serving many users), the impact is serious - full session-credential theft - but the 'unauthenticated, default-config' reading of PR:N/AC:L overstates typical exposure, since most private/per-user cache deployments never reach the vulnerable path. Net: a genuine high-confidentiality bug worth prioritizing for any operator running http-cache-semantics behind a shared cache, but not a broad, automatable internet-wide threat on the strength of the score alone.

An application uses http-cache-semantics to govern a shared HTTP cache that at some point stored an authenticated response (with a Set-Cookie session credential) that the library flagged/zeroed as security-sensitive and not to be reserved. An unauthenticated attacker requests the same URL with a large Cache-Control: max-stale value; the flawed max-stale handling fails to honor the security-zeroing and returns the retained cached response, leaking another user's session cookie. VulnCheck's advisory documents the flaw and points to the exact source lines, but no standalone public exploit is identified in the provided data.