CVE-2026-108088: Apache Cocoon: Cross-user cache poisoning
UNSUPPORTED WHEN ASSIGNED Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users.
This issue affects Apache Cocoon: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the Apache Cocoon instance to trusted users.
- Compensating control
Find an alternative to Apache Cocoon, which is retired and has no planned fixing version.
Event History
Frequently Asked Questions
Which deployments are exposed to cross-user data disclosure?
Deployments that use Apache Cocoon caching in a multi-user application are affected. Cached values associated with one user may be served to other users.
Is a vendor patch available?
No. Apache Cocoon is retired, and no fixed release is planned; the issue affects all versions.
What can be done if the application cannot be replaced immediately?
Restrict access to the Cocoon instance to trusted users. The recommended long-term action is to migrate to an alternative product.