Critical severity · published Oct 14, 2026
CVE-2026-102476
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should…
9.1
CVSS
0.2%
EPSS
No
On KEV
Description
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation.
The impacted component is io.vertx:vertx-core.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EV
Eclipse Vert.x · Eclipse Foundation
5.0.0 through 5.0.12; 5.1.0 through 5.1.9; 5.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102476
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102476
github.com
https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-2vhw-4xwj-r38v
gitlab.eclipse.org
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/350
More from Eclipse Vert.x
7.5
CVE-2026-15075
In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across…
7.5
CVE-2026-15076
In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute…
7.5
CVE-2024-8391
Eclipse Vert.x gRPC server does not limit the maximum message size
5.9
CVE-2026-102477
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes,…
5.9
CVE-2026-102464
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH…