{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vert.x-4.0.0-4.5.35-5.0.0-5.2.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:5.2.0:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:vertx:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.9,"id":"CVE-2026-102479"},{"cvss":7.5,"id":"CVE-2026-118489"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Vert.x","Vert.x (4.0.0-4.5.35, 5.0.0-5.2.2)"],"_cs_severities":["high"],"_cs_tags":["web-application","request-smuggling","cve-2026-102479","web-vulnerability","data-leakage","application-security"],"_cs_type":"advisory","_cs_vendors":["Eclipse"],"content_html":"\u003cp\u003eA request smuggling vulnerability has been identified in the Eclipse Vert.x HTTP/1.x decoder, tracked as CVE-2026-102479. The vulnerability arises from how the library handles specific HTTP header patterns, potentially allowing an attacker to manipulate request interpretation. This flaw can lead to downstream impacts, including session fixation. The vulnerability affects three specific minor release branches of the vertx-core component.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may allow attackers to perform request smuggling, which can lead to session fixation or other unauthorized operations depending on the architecture of the application utilizing the affected Vert.x component.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory applications utilizing vertx-core to determine if they are running on the affected minor release branches.\u003c/li\u003e\n\u003cli\u003ePrioritize patching by upgrading to the secure version of Vert.x released by the vendor in response to GHSA-ch7p-g5pm-3gqx.\u003c/li\u003e\n\u003cli\u003eReview application logic for dependencies on header integrity if upgrading is not immediately feasible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T16:01:20Z","date_published":"2026-10-28T20:24:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vertx-request-smuggling/","summary":"Eclipse Vert.x contains a request smuggling vulnerability in its HTTP/1.x decoder (CVE-2026-102479) that can be leveraged for session fixation attacks.","title":"Eclipse Vert.x: Request smuggling in HTTP/1.x decoder (CVE-2026-102479)","url":"https://feed.craftedsignal.io/briefs/2026-10-vertx-request-smuggling/"}],"language":"en","title":"CraftedSignal Threat Feed - Vert.x (4.0.0-4.5.35, 5.0.0-5.2.2)","version":"https://jsonfeed.org/version/1.1"}