Eclipse Foundation Vert.x vulnerabilities

• eclipse foundation vert.x Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser CVE-2026-118487 7.5 HighNovember 3, 2026
• eclipse foundation vert.x Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client CVE-2026-118488 5.9 MediumNovember 3, 2026
• eclipse foundation vert.x CachingWebClient shares user-specific HTTP responses across users via the shared cache tier CVE-2026-118489 7.5 HighNovember 3, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102477 8.7 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102464 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102461 8.7 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-103224 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-103223 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102466 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102463 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102469 9.2 CriticalOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102462 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102465 8.2 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy... CVE-2026-102475 8.7 HighOctober 15, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102467 8.7 HighOctober 15, 2026
• eclipse vert.x CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages CVE-2026-102471 6.9 MediumOctober 14, 2026
• eclipse vert.x In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets w… CVE-2026-102479 8.7 HighOctober 14, 2026
• eclipse vert.x In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... CVE-2026-102460 8.6 HighOctober 14, 2026
• eclipse foundation vert.x In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the… CVE-2026-102476 9.1 CriticalOctober 14, 2026
• eclipse vert.x In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirec… CVE-2026-15075 8.2 HighJuly 14, 2026
• eclipse vert.x In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession... CVE-2026-15076 8.2 HighJuly 14, 2026
• eclipse vert.x Vert.x has a DoS via unbounded server-side SNI SslContext cache growth CVE-2026-6860 Fix available 6.9 MediumMay 6, 2026
• eclipse foundation vert.x, eclipse vert.x-web +1 more Eclipse Vert.x Web static handler file access denial CVE-2026-1002 Fix available 6.9 MediumJanuary 15, 2026
• eclipse vert.x Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories CVE-2025-11965 Fix available 6.3 MediumOctober 22, 2025
• eclipse vert.x Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names CVE-2025-11966 Fix available 2.3 LowOctober 22, 2025
• eclipse vert.x Eclipse Vert.x gRPC server does not limit the maximum message size CVE-2024-8391 Fix available 6.9 MediumSeptember 4, 2024
• eclipse vert.x, the eclipse foundation eclipse vert.x +1 more Path Traversal in Eclipse Vert CVE-2019-17640 Public exploitFix available 9.8 CriticalOctober 15, 2020
• eclipse vert.x, the eclipse foundation eclipse vert.x +1 more Moderate severity vulnerability that affects io.vertx:vertx-core CVE-2018-12544 Fix available 9.8 CriticalOctober 10, 2018
• eclipse vert.x, the eclipse foundation eclipse vert.x +1 more Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location CVE-2018-12542 Public exploitFix available 9.8 CriticalOctober 10, 2018
• eclipse vert.x, the eclipse foundation eclipse vert.x +1 more Excessive memory allocation CVE-2018-12541 Fix available 6.5 MediumOctober 10, 2018
• eclipse vert.x, the eclipse foundation eclipse vert.x +1 more Moderate severity vulnerability that affects io.vertx:vertx-core CVE-2018-12537 Public exploitFix available 5.3 MediumAugust 14, 2018
• eclipse vert.x, the eclipse foundation eclipse vert.x +1 more High severity vulnerability that affects io.vertx:vertx-web CVE-2018-12540 Public exploitFix available 8.8 HighJuly 12, 2018