CVE-2026-102479

Undergoing Analysis Undergoing Analysis - In Progress

HTTP Request Smuggling in Eclipse Vert.x Core

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Eclipse Foundation

Description

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length. This can be exploited for request smuggling purpose. The impacted component is io.vertx:vertx-core.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102479

EUVD

EUVD-2026-101557

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse	Foundation	Eclipse Vert.x 5.0.0
Eclipse	Foundation	Eclipse Vert.x 5.1.0
Eclipse	Foundation	Eclipse Vert.x 5.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability affects Eclipse Vert.x versions between 5.0.0-5.0.12, 5.1.0-5.1.9, and 5.2.0. The HTTP/1.x decoder incorrectly handles header canonicalization, allowing crafted headers like Content-Xength to be misinterpreted as Content-Length. This enables request smuggling attacks where attackers manipulate HTTP requests.

Detection Guidance

Detecting this vulnerability requires checking for request smuggling attempts by monitoring HTTP header manipulation. Inspect network traffic for malformed headers like 'Content-Xength' or similar variations of standard headers. Use tools like Wireshark or tcpdump to capture and analyze HTTP requests for anomalies in header canonicalization.

Impact Analysis

An attacker could exploit this to perform request smuggling, potentially bypassing security controls, accessing unauthorized data, or disrupting services. It may allow manipulation of HTTP requests and responses between clients and servers using Vert.x.

Compliance Impact

This vulnerability enables request smuggling, which could allow attackers to bypass security controls, access unauthorized data, or manipulate requests. For GDPR, this may lead to unauthorized data access or processing, violating principles of data protection and user rights. For HIPAA, it could compromise the confidentiality and integrity of protected health information by allowing unauthorized access or alteration of data.

Mitigation Strategies

Immediately upgrade to patched versions of Eclipse Vert.x: 5.1.10 or 5.2.1. If upgrading is not possible, apply network-level mitigations such as using a web application firewall (WAF) to filter malformed headers. Disable or restrict HTTP/1.x traffic if feasible until the patch is applied.

Hi! I’m here to help you understand CVE-2026-102479. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70