CVE-2026-102476
9.1CriticalPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-295
Impact
Remote attackers can potentially intercept or tamper with encrypted traffic via man-in-the-middle attacks when the HTTP client reuses an insecure SSL context. Attackers need a network position capable of intercepting connections.
Root cause
The HTTP client's SSL context cache key does not fully incorporate all SSL properties, allowing requests requiring strict validation to receive an insecure cached context that skips checks like hostname verification.
Affected systems
Eclipse Vert.x (io.vertx:vertx-core) versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0.
CVSS v4.0 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade io.vertx:vertx-core to fixed releases beyond the affected ranges (e.g., 5.0.13, 5.1.10, or 5.2.1 if available; check vendor advisory for exact target releases). No interim workaround is specified in the advisory.
$ ./mvnw dependency:tree -Dincludes=io.vertx:vertx-coreAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation. The impacted component is io.vertx:vertx-core.