http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.

atlassian_jira_service_management JSDSERVER-16728: DoS (Denial of Service) io.netty:netty-codec Dependency in Jira Service Management Data Center

atlassian_jira_service_management JSDSERVER-16756: RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Jira Service Management Data Center

atlassian_confluence CONFSERVER-104437: RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Confluence Data Center

atlassian_confluence CONFSERVER-104397: Broken Authentication & Session Management org.bouncycastle:bcpkix-lts8on Dependency in Confluence Data Center

atlassian_confluence CONFSERVER-104419: DoS (Denial of Service) io.netty:netty-codec Dependency in Confluence Data Center

atlassian_confluence CONFSERVER-104423: DoS (Denial of Service) io.netty:netty-codec-http Dependency in Confluence Data Center

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16840 advisory.

  - http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when     processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses     belonging to other users. Attackers can request the same URL with a large max-stale value to obtain     another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for     security reasons. (CVE-2026-93748)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when
    processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses
    belonging to other users. Attackers can request the same URL with a large max-stale value to obtain
    another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for
    security reasons. (CVE-2026-93748)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when     processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses     belonging to other users. Attackers can request the same URL with a large max-stale value to obtain     another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for     security reasons. (CVE-2026-93748)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
367909	Atlassian Jira Service Management Data Center and Server 11.3.x < 11.3.5 (JSDSERVER-16840)	Nessus	Misc.	Local	high
473063	Chainguard: prism: security update to 5.16.0-r14	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
473063	Chainguard: prism: security update to 5.16.0-r14	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
472162	SCA: security update for http-cache-semantics (GHSA-ch52-4w7c-c8xp)	Tenable Cloud Security	SCA Checks	Local	high
472162	SCA: security update for http-cache-semantics (GHSA-ch52-4w7c-c8xp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
348643	Linux Distros Unpatched Vulnerability : CVE-2026-93748	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-93748

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high