{"id":"CVE-2026-108088","aliases":[],"cve":{"records":[{"id":"CVE-2026-108088","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":true,"reserved":"2026-10-09T12:25:37.471Z","published":"2026-10-20T10:25:33.049Z","modified":"2026-10-29T17:33:40.096Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-10-20T10:25:33.049Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-10-20T18:09:56.009Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T17:33:40.096Z"}],"references":[{"url":"https://lists.apache.org/thread/30vg3mht5vsm9vsmrdnx80zp5fw536st","tags":["vendor-advisory"],"source":"apache"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/4","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-524","description":"CWE-524 Use of cache containing sensitive information","source":"apache"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T17:30:43.005593Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Apache Cocoon: Cross-user cache poisoning","titleSource":"apache","descriptionSource":"apache","description":"** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users.\n\n\n\nThis issue affects Apache Cocoon: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","score":7.5,"severity":"high","published":"2026-10-20T10:25:33.049Z","modified":"2026-10-29T17:33:40.096Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Cocoon","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"*","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/cocoon","cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-108088"}],"remediation":[],"references":["https://lists.apache.org/thread/30vg3mht5vsm9vsmrdnx80zp5fw536st","http://www.openwall.com/lists/oss-security/2026/10/20/4"],"sources":[{"name":"CVE","id":"CVE-2026-108088","modified":"2026-10-29T17:33:40.096Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-108088"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-29T17:51:04.067Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T04:05:32.009Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T18:10:35.461Z","attemptedAt":"2026-10-29T18:10:35.461Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T18:10:36.773Z","attemptedAt":"2026-10-29T18:10:36.773Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T18:10:36.232Z","attemptedAt":"2026-10-29T18:10:36.232Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-29T18:10:35.592Z","attemptedAt":"2026-10-29T18:10:35.592Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-108088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108088","modified":"2026-10-20T19:34:00.700","checkedAt":"2026-10-29T18:10:35.461Z"},{"source":"FIRST EPSS","id":"CVE-2026-108088","url":"https://www.first.org/epss/","probability":0.0024,"percentile":0.15172,"date":"2026-10-29","checkedAt":"2026-10-29T18:10:35.592Z"},{"source":"ENISA EUVD","id":"EUVD-2026-104913","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104913","modified":"Oct 29, 2026, 5:33:40 PM","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-10-29T18:10:36.232Z"},{"source":"GitHub Advisory Database","id":"GHSA-2p79-44fm-p992","url":"https://github.com/advisories/GHSA-2p79-44fm-p992","modified":"2026-10-20T21:30:51Z","checkedAt":"2026-10-29T18:10:36.773Z"}],"aiSummary":{"text":"Apache Cocoon has a cross-user cache poisoning vulnerability, affecting all versions, where cached values for one user could be used when serving content for other users. The project is retired and no fix is planned. Users are advised to find an alternative or restrict access to trusted users.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:53:53.457Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-108088"}]}}