The CachingWebClient component in Eclipse Vert.x can store user‑specific HTTP responses in a shared cache if those responses are cacheable and lack the private or no‑store cache‑control header. This flaw allows a later user, or an anonymous caller using the same client, to receive a response originally intended for a different user, potentially exposing authenticated content or session cookies. The vulnerability results from inadequate cache‑control handling (CWE‑200) and improper segregation of cached data (CWE‑524).

Eclipse Vert.x versions 4.0.0 through 4.5.35 and 5.0.0 through 5.2.2 are affected whenever a per‑user WebClientSession is layered atop a shared CachingWebClient instance.

The flaw has a CVSS score of 7.5, indicating high severity. EPSS is not available and the vulnerability is not included in the CISA KEV catalog. Based on the description, the attack vector is inferred to be local or application‑level: an attacker who can influence or access a shared CachingWebClient instance can cause sensitive responses to be cached and later retrieved by another user, enabling information disclosure or session hijacking.