Web Cache Poisoning: How Attackers Exploit Cache Key Mismatches to Serve Malicious Content

Web cache poisoning is a security vulnerability that arises from a mismatch between how a cache identifies requests and how the origin server generates responses. Caches use a 'cache key' — often just the URL path — to decide whether a stored response can be reused, while origin servers may factor in additional request data such as headers or query parameters. An attacker can exploit this gap by sending a request with malicious input that influences the origin's response but is excluded from the cache key, causing that tainted response to be stored. Subsequent legitimate users requesting the same URL then receive the attacker-controlled response directly from the cache. Critically, the cache itself is not compromised — it behaves as designed, making the attack difficult to detect through standard cache monitoring.