Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

Eclipse Vert.x may reuse insecure encryption settings

CVE-2026-102476 · published 1 day ago
Summary

The HTTP client in Eclipse Vert.x versions 5.0.0‑5.0.12, 5.1.0‑5.1.9, and 5.2.0 can mistakenly reuse a saved encryption setup that does not include the security checks you requested, such as verifying the server’s name. This could let a connection appear safe while actually using weaker protection. Upgrade to a newer Vert.x release or apply the vendor’s patch to ensure each connection uses the exact security settings you specify.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
eclipse foundation eclipse vert.x <= 5.0.12
Original advisory text
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely t...
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation.



The impacted component is io.vertx:vertx-core.
References
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Timeline
Published14 Oct 2026
Updated16 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-102476 · NVD
CVE-2026-102476 · MITRE
CVE-2026-102476 · OSV
GHSA-2vhw-4xwj-r38v · GHSA
Track software like this
Free during beta