Request smuggling in Eclipse Vert.x HTTP/1.x decoder (CVE-2026-102479)
Original title: CVE-2026-102479: Request smuggling in Eclipse Vert.x HTTP/1.x decoder
JFrog says vertx-core has about 2,100 Maven dependents, but the exposed window covers only three minor branches.
An oss-security post points to an Eclipse advisory for CVE-2026-102479, a request-smuggling flaw in the Vert.x HTTP/1.x decoder. A JFrog write-up describes how the issue can be exploited. The snippet says three minor release branches shipped the flaw but cuts off before naming versions or fixes.
Unconfirmed: The feed snippet ends before naming the three affected minor branches or any fixed versions.
- The advisory is GHSA-ch7p-g5pm-3gqx on the Eclipse Vert.x GitHub.
- JFrog cites about 2,100 Maven dependents and over 300 million cumulative downloads.
- Those download figures cover the project’s entire history, not only the exposure window.
Impact: HTTP request smuggling via the Vert.x HTTP/1.x decoder
| Product | Affected |
|---|---|
| Eclipse Vert.x | — |
- CVEs
- CVE-2026-102479
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102479 | HTTP request smuggling in Eclipse Vert.x HTTP/1 decoder | 8.7 | — |
From the original article
Posted by Alan Coopersmith on Oct 28 https://github. com/eclipse-vertx/vert. x/security/advisories/GHSA-ch7p-g5pm-3gqx https://research.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.