Unscored severity · published Oct 20, 2026
CVE-2026-108088
Apache Cocoon: Cross-user cache poisoning
–
CVSS
0.2%
EPSS
No
On KEV
Description
** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
Affected product
AC
Apache Cocoon
Apache Software Foundation
More from Apache Cocoon
7.5
CVE-2026-108089
Apache Cocoon: Unauthenticated access to diagnostic interfaces
–
CVE-2026-108087
Apache Cocoon: SQL Injection
–
CVE-2026-108086
Apache Cocoon: XEE could lead to SSRF and information disclosure