https://seclists.org/oss-sec/2026/q4/426: CVE-2026-102479: Request smuggling in Eclipse Vert.x HTTP/1.x decoder

Q: Which Vert.x Core versions need remediation?

The affected Maven package is io.vertx:vertx-core in versions 5.0.0 through 5.1.8, plus 5.2.0. Fixed versions are 5.1.10 and 5.2.1.

Q: What does an attacker need to exploit this issue?

The issue is remotely exploitable over the network with low attack complexity and requires no privileges or user interaction. Exploitation relies on sending carefully crafted HTTP/1.x headers that are incorrectly canonicalized, such as Content-Xength being treated as Content-Length.

Q: What is the likely security impact?

The reported impact is request smuggling, with CVSS 7.5 rated High. The supplied CVSS vector indicates integrity impact, with no reported confidentiality or availability impact.

Published Oct 28, 2026

Updated

Affected Software

1 affected component

maven/io.vertx/vertx-core>=5.0.0<=5.1.8, =5.2.0

Frequently Asked Questions

Which Vert.x Core versions need remediation?

The affected Maven package is io.vertx:vertx-core in versions 5.0.0 through 5.1.8, plus 5.2.0. Fixed versions are 5.1.10 and 5.2.1.

What does an attacker need to exploit this issue?

The issue is remotely exploitable over the network with low attack complexity and requires no privileges or user interaction. Exploitation relies on sending carefully crafted HTTP/1.x headers that are incorrectly canonicalized, such as Content-Xength being treated as Content-Length.

What is the likely security impact?

The reported impact is request smuggling, with CVSS 7.5 rated High. The supplied CVSS vector indicates integrity impact, with no reported confidentiality or availability impact.