http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when
    processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses
    belonging to other users. Attackers can request the same URL with a large max-stale value to obtain
    another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for
    security reasons. (CVE-2026-93748)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when     processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses     belonging to other users. Attackers can request the same URL with a large max-stale value to obtain     another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for     security reasons. (CVE-2026-93748)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473063	Chainguard: prism: security update to 5.16.0-r14	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
473063	Chainguard: prism: security update to 5.16.0-r14	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
472162	SCA: security update for http-cache-semantics (GHSA-ch52-4w7c-c8xp)	Tenable Cloud Security	SCA Checks	Local	high
472162	SCA: security update for http-cache-semantics (GHSA-ch52-4w7c-c8xp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
348643	Linux Distros Unpatched Vulnerability : CVE-2026-93748	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-93748

high

Tenable Plugins

high

high

high

high

high