HTTP Request Smuggling in Eclipse Vert.x Core

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Eclipse Foundation

Description

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length. This can be exploited for request smuggling purpose. The impacted component is io.vertx:vertx-core.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-15

EPSS Evaluated

N/A

NVD

CVE-2026-102479

EUVD

EUVD-2026-101557

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse	Foundation	Eclipse Vert.x 5.0.0
Eclipse	Foundation	Eclipse Vert.x 5.1.0
Eclipse	Foundation	Eclipse Vert.x 5.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions have not been generated yet.

Hi! I’m here to help you understand CVE-2026-102479. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70