Skip to content
Threat Feed
Subscribe
high advisory updated

Eclipse Vert.x: Request smuggling in HTTP/1.x decoder (CVE-2026-102479)

Eclipse Vert.x contains a request smuggling vulnerability in its HTTP/1.x decoder (CVE-2026-102479) that can be leveraged for session fixation attacks.

CVE search metadata

CVE search record: CVE-2026-102479. Severity: medium. CVSS: 5.9. EPSS: 0.27%. KEV: no. Product: Vert.x, Vert.x (4.0.0-4.5.35, 5.0.0-5.2.2). Brief: Eclipse Vert.x: Request smuggling in HTTP/1.x decoder (CVE-2026-102479). Brief link: https://feed.craftedsignal.io/briefs/2026-10-vertx-request-smuggling/

CVE search record: CVE-2026-118489. Severity: high. CVSS: 7.5. KEV: no. Product: Vert.x, Vert.x (4.0.0-4.5.35, 5.0.0-5.2.2). Brief: Eclipse Vert.x: Request smuggling in HTTP/1.x decoder (CVE-2026-102479). Brief link: https://feed.craftedsignal.io/briefs/2026-10-vertx-request-smuggling/

Triage facts

Revision 1
Applicability
Vert.x, Vert.x (4.0.0-4.5.35, 5.0.0-5.2.2)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
4 public sources
Freshness
Revision 1Oct 28, 20:24 UTC
Vulnerabilities
2 CVEs
Source quality
A1Likely

What's new

  • 1. added coverage for Vert.x (4.0.0-4.5.35, 5.0.0-5.2.2) Nov 3, 16:01 via nvd

A request smuggling vulnerability has been identified in the Eclipse Vert.x HTTP/1.x decoder, tracked as CVE-2026-102479. The vulnerability arises from how the library handles specific HTTP header patterns, potentially allowing an attacker to manipulate request interpretation. This flaw can lead to downstream impacts, including session fixation. The vulnerability affects three specific minor release branches of the vertx-core component.

Impact

Successful exploitation may allow attackers to perform request smuggling, which can lead to session fixation or other unauthorized operations depending on the architecture of the application utilizing the affected Vert.x component.

Recommendation

  • Inventory applications utilizing vertx-core to determine if they are running on the affected minor release branches.
  • Prioritize patching by upgrading to the secure version of Vert.x released by the vendor in response to GHSA-ch7p-g5pm-3gqx.
  • Review application logic for dependencies on header integrity if upgrading is not immediately feasible.

Immediate actions

Identify all applications using the affected vertx-core library branches.

IT Operations 48h

Inventory all internal applications utilizing Eclipse Vert.x to identify exposure to CachingWebClient usage.

Application Security 48h

Threat Hunt

Audit access logs for authenticated HTTP responses lacking private/no-store headers that are subsequently accessed by different user sessions within the same application process.

T1539 medium medium confidence hunt now

Data: Application-level access logs, Response header metadata

Mitigations

Upgrade vulnerable Vert.x applications to the patched release branch version.

immediate IT Operations

CVE-2026-102479

Implement strict Cache-Control headers (private, no-store) on all authenticated endpoints to prevent improper caching.

medium IT Operations

CVE-2026-118489