http-cache-semantics through 4.2.0 mishandles client max-stale directives by not validating security-zeroed shared-cache entries. Unauthenticated attackers can request the same URL with a large max-stale to retrieve another user’s cached response, including Set-Cookie session credentials. Remediate by upgrading past 4.2.0 and preventing shared caching of authenticated responses.