CVE-2026-102476

Awaiting Analysis Awaiting Analysis - Queue

Vert.x HTTP Client SSL Context Weakness

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Eclipse Foundation

Description

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation. The impacted component is io.vertx:vertx-core.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102476

EUVD

EUVD-2026-101530

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse	Foundation	Eclipse Vert.x 5.0.0
Eclipse	Foundation	Eclipse Vert.x 5.1.0
Eclipse	Foundation	Eclipse Vert.x 5.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Eclipse Vert.x HTTP client in versions 5.0.0 to 5.1.9 and 5.2.0. The issue is with the SSL context cache key, which does not fully reflect the SSL properties requested by a client. As a result, a client may receive an SSL context with weaker security settings than intended, such as one that ignores hostname validation.

Detection Guidance

Check Vert.x HTTP client versions in use. Commands like 'find . -name "vertx-core*.jar" -exec jar tf {} \; | grep -i "SSLContext"' can help identify affected versions. Monitor network traffic for unencrypted or improperly secured connections.

Impact Analysis

This vulnerability could expose sensitive data due to improper SSL context handling. Attackers might exploit weaker SSL properties to intercept or manipulate communications, potentially leading to data breaches or unauthorized access to confidential information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to improper SSL context handling. Weakened SSL properties like missing hostname validation may expose sensitive data during transmission, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade io.vertx:vertx-core to versions 5.1.10 or 5.2.1 or later. If upgrading is not possible, disable SSL context caching or implement custom SSL context configuration to enforce required properties like hostname validation.

Hi! I’m here to help you understand CVE-2026-102476. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70