CVE-2026-102471: CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value passed to MailMessage.addHeader(), MailMessage.setHeaders(), MailAttachment.addHeader(), or MailAttachment.setHeaders() is written verbatim to the wire, allowing an attacker to inject arbitrary headers (e.g. Bcc, Reply-To, Content-Type) or prepend body content to the outgoing message.
The same weakness affects MIME part metadata set via MailAttachment.setContentType(), setDisposition(), setDescription(), and setContentId(), which are written directly into MIME part headers without validation.
A secondary weakness in Utils.mustEncode(char) additionally allows a bare LF in a From display-name to bypass Q-encoding and reach the wire unchanged.
An unauthenticated attacker who can control any header name, header value, or attachment metadata field passed to the mail client (for example via a web form or API that feeds into MailMessage) can exploit this to redirect email copies, spoof headers, or tamper with message structure.
The impacted component is io.vertx:vertx-mail-client.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using vertx-mail-client are exposed when untrusted input can reach MailMessage.addHeader(), MailMessage.setHeaders(), MailAttachment.addHeader(), MailAttachment.setHeaders(), or attachment metadata setters. Examples include web forms or APIs that pass user-controlled values into outgoing email construction.
What does an attacker need to exploit it?
An attacker does not need authentication if they can control a header name, header value, or attachment metadata field that the application passes to the mail client. They can supply CR/LF sequences to inject SMTP or MIME headers, or to prepend message body content.
Which releases are affected?
Affected releases are Eclipse Vert.x 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0. The described behavior also includes a bare-LF bypass in a From display name due to Utils.mustEncode(char).