CVE-2026-102479

Eclipse Vert.x’s HTTP/1.x decoder in the listed 5.x releases canonicalizes well-known header names so that a crafted name can be treated as one of those headers—for example, Content-Xength interpreted as Content-Length. A remote, unauthenticated attacker can send such headers so Vert.x and another HTTP parser (often a reverse proxy) disagree on request boundaries, which is a classic HTTP request-smuggling condition. That mismatch can change how later requests are processed; the published CVSS 4.0 score is 8.7 with high integrity impact on the vulnerable component and no confidentiality or availability impact in the base metrics. Applications and services that embed io.vertx:vertx-core and terminate HTTP/1.x on 5.0.0–5.0.12, 5.1.0–5.1.9, or 5.2.0 are affected, particularly when they sit behind a proxy. No public proof-of-concept is known and the issue is not in CISA’s Known Exploited Vulnerabilities catalog.

What to do: Upgrade io.vertx:vertx-core to a release outside the affected ranges (later than 5.0.12 on the 5.0 line, later than 5.1.9 on the 5.1 line, and later than 5.2.0 on the 5.2 line) using the Eclipse advisory’s fixed builds. Prioritize internet-facing or reverse-proxy-fronted HTTP/1.x services, and until they are patched limit exposure of those endpoints and review logs for malformed lookalike header names.