VE
Product
Vert.x
27
CVEs
0
On KEV
9.8
Max CVSS
15
New 30D
Severity mix
Critical 3High 5Medium 19Low 0
Watch
Add Vert.x to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-12541 | 6.5 | Oct 10 | In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request… Affected: 3.0.0 before 3.5.4 |
| CVE-2025-11966 | 6.4 | Oct 22 | In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper… Affected: 4.0.0 before 4.5.22; 5.0.0 before 5.0.5 |
| CVE-2026-102477 | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes,… Affected: 4.5.0 before 4.5.35; 5.0.0 before 5.2.0; 5.2.0 |
| CVE-2026-102464 | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH… Affected: 4.5.0 before 4.5.35; 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-102461 | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no… Affected: 4.5.0 before 4.5.35; 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-103224 | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a… Affected: 4.5.0 before 4.5.35; 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-103223 | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the… Affected: 4.5.0 before 4.5.35; 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-102466 | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column… Affected: 4.5.0 before 4.5.35; 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-102463 | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray)… Affected: 4.5.0 before 4.5.35; 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-102469 | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that… Affected: 4.5.0 before 4.5.35; 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-102462 | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates… Affected: 4.5.0 before 4.5.35; 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-102465 | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by… Affected: 4.5.0 before 4.5.35; 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-102475 | 5.9 | Oct 15 | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to… Affected: 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-102467 | 5.9 | Oct 15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation… Affected: 4.5.0 before 4.5.35; 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-102471 | 5.9 | Oct 14 | CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages Affected: 4.5.0 before 4.5.35; 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-102479 | 5.9 | Oct 14 | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization… Affected: 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-102460 | 5.9 | Oct 14 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when… Affected: 4.5.0 before 4.5.35; 5.0.0 before 5.1.10; 5.2.0 |
| CVE-2026-6860 | 5.3 | May 6 | A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g Affected: 4.3.4 through 4.5.26; 5.0.0 through 5.0.11 |
| CVE-2018-12537 | 5.3 | Aug 14 | In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value Affected: 3.0.0 through 3.5.1 |
Showing 19