io.vertx:vertx-web-client@5.0.0.CR5

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the CacheInterceptor class, whose shared cache key carries no per-user marker and which decides to store a response in the client level shared tier from Cache-Control and Expires alone. An attacker can read another user's response body by requesting the same URL through a CachingWebClient that serves multiple principals, since a response to a request carrying an Authorization header is stored in the shared tier even though max-age alone does not make it shareable, after which a session private miss falls back to that tier and an anonymous request receives the stored body in place of the origin's 401. Where the stored response carries Set-Cookie, the cookie is replayed verbatim to later callers, handing one user's session identifier to another and enabling session fixation or hijacking. Both cases require a single CachingWebClient shared across user principals, which is the documented pattern of a per-user WebClientSession layered over a shared caching client, together with an origin that marks the response cacheable without private or no-store.

Upgrade io.vertx:vertx-web-client to version 4.5.36, 5.2.3 or higher.