CVE-2026-108088: falha em Apache Cocoon
Apache Cocoon: Cross-user cache poisoning
Publicada em
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.2%
probabilidade de exploração
0.2%top 86% das CVEs
exploração observada
nãonenhuma fonte reporta
** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users.
This issue affects Apache Cocoon: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Produtos afetados
Apache Software Foundation · Apache CocoonCVEs relacionadas — Apache Cocoon
No mesmo produto, das mais perigosas para as menos.
CVE-2023-49733—Apache Cocoon's StreamGenerator is vulnerable to XXE injectionEPSS 1.3%CVE-2022-45135CRITICALApache Cocoon: SQL injection in DatabaseCookieAuthenticatorActionEPSS 1.1%CVE-2025-24783HIGHApache Cocoon: continuations may not be privateEPSS 0.8%CVE-2026-108089HIGHApache Cocoon: Unauthenticated access to diagnostic interfacesEPSS 0.5%CVE-2026-108087—Apache Cocoon: SQL InjectionEPSS 0.3%CVE-2026-108086—Apache Cocoon: XEE could lead to SSRF and information disclosureEPSS 0.2%