All vulnerabilities
CVE-2026-102476GHSA-2vhw-4xwj-r38v

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the

Eclipse Foundation Eclipse Vert.x
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.1.10Also 5.2.1GitHub
Published14 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

  • 5.1.10io.vertx:vertx-core, mavenGitHub<dependency><groupId>io.vertx</groupId><artifactId>vertx-core</artifactId><version>5.1.10</version></dependency>
  • 5.2.1io.vertx:vertx-core, mavenGitHub<dependency><groupId>io.vertx</groupId><artifactId>vertx-core</artifactId><version>5.2.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation.

The impacted component is io.vertx:vertx-core.

Text from GitHub Advisory Database

Affected versions 5

  • Eclipse Vert.xaffected: 5.0.0 through 5.0.12CVE List
  • Eclipse Vert.xaffected: 5.1.0 through 5.1.9CVE List
  • Eclipse Vert.xaffected: 5.2.0CVE List
  • io.vertx:vertx-core, maven>= 5.0.0, <= 5.1.8GitHub
  • io.vertx:vertx-core, maven5.2.0GitHub

References 2