CVE-2026-102476: Maven/io.vertx/vertx-core vulnerability

Q: Which deployments should be investigated first?

Investigate applications that use the Vert.x HTTP client from io.vertx:vertx-core and make SSL/TLS connections while using versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, or 5.2.0.

Q: What condition causes the unsafe TLS behavior?

The issue occurs when the HTTP client requests an SSL context with particular security properties but receives a cached context created with weaker properties. The documented example is a request requiring hostname validation receiving a context that ignores hostname validation.

Q: How can I determine whether an application is in scope?

Check the resolved Maven dependency version for io.vertx:vertx-core, rather than only the version declared directly by the application. Versions in the listed affected ranges should be treated as requiring investigation if the application uses the Vert.x HTTP client with SSL/TLS.

Published Oct 14, 2026

Updated

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation.

The impacted component is io.vertx:vertx-core.

Affected Software

1 affected component

maven/io.vertx/vertx-core>=5.0.0<=5.0.12, >=5.1.0<=5.1.9, >=5.2.0<=5.2.0

Event History

Oct 14, 2026

CVE Published

via MITRE·06:11 PM

Data Sourced

via MITRE·06:11 PM

Description

Frequently Asked Questions

Which deployments should be investigated first?

Investigate applications that use the Vert.x HTTP client from io.vertx:vertx-core and make SSL/TLS connections while using versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, or 5.2.0.

What condition causes the unsafe TLS behavior?

The issue occurs when the HTTP client requests an SSL context with particular security properties but receives a cached context created with weaker properties. The documented example is a request requiring hostname validation receiving a context that ignores hostname validation.

How can I determine whether an application is in scope?

Check the resolved Maven dependency version for io.vertx:vertx-core, rather than only the version declared directly by the application. Versions in the listed affected ranges should be treated as requiring investigation if the application uses the Vert.x HTTP client with SSL/TLS.