CVE-2026-102479

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length. This can be exploited for request smuggling purpose. The impacted component is io.vertx:vertx-core.

Vendor	eclipse foundation
Product	eclipse vert.x
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse vert.x

Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse vert.x are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / Eclipse Vert.x

5.0.0 ≤ 5.0.12 5.1.0 ≤ 5.1.9 5.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-ch7p-g5pm-3gqx gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/352

Credits

Mike Read