All vulnerabilities
CVE-2026-102479GHSA-ch7p-g5pm-3gqx

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets w

Eclipse Foundation Eclipse Vert.x
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.1.10Also 5.2.1GitHub
Published14 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

  • 5.1.10io.vertx:vertx-core, mavenGitHub<dependency><groupId>io.vertx</groupId><artifactId>vertx-core</artifactId><version>5.1.10</version></dependency>
  • 5.2.1io.vertx:vertx-core, mavenGitHub<dependency><groupId>io.vertx</groupId><artifactId>vertx-core</artifactId><version>5.2.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length.

This can be exploited for request smuggling purpose.

The impacted component is io.vertx:vertx-core.

Text from GitHub Advisory Database

Affected versions 5

  • Eclipse Vert.xaffected: 5.0.0 through 5.0.12CVE List
  • Eclipse Vert.xaffected: 5.1.0 through 5.1.9CVE List
  • Eclipse Vert.xaffected: 5.2.0CVE List
  • io.vertx:vertx-core, maven>= 5.0.0, <= 5.1.8GitHub
  • io.vertx:vertx-core, maven5.2.0GitHub

References 2