This vulnerability in CoreBunch Instatic (versions before 0.0.15) involves cache poisoning via the u query parameter of the GET /_instatic/hole/<nodeId> endpoint. An unauthenticated remote attacker can manipulate the shared render cache, potentially causing inconsistent or malicious content to be served. The issue stems from inconsistent interpretation of HTTP requests, a known class of flaws under CWE-444, commonly referred to as HTTP Request/Response Smuggling. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, but requiring user interaction and causing partial confidentiality and integrity impact with no availability impact. No known exploits are reported in the wild, and no vendor remediation or patch is currently documented.

An unauthenticated remote attacker can poison the shared render cache by manipulating a query parameter, potentially causing users to receive incorrect or maliciously crafted content. The impact includes partial loss of confidentiality and integrity of data served by the affected endpoint. There is no reported impact on availability. This could lead to information disclosure or content manipulation but does not allow direct system compromise or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint or implementing additional input validation and cache controls as temporary mitigations. Monitor vendor channels for updates and apply patches promptly once available.