CVE-2026-102471: Vulnerability in Eclipse Foundation Eclipse Vert.x

Eclipse Vert.x versions >=4.0.0 <=4.5.34, >=5.0.0 <=5.0.12, >=5.1.0 <=5.1.9, and =5.2.0 contain a vulnerability in the vertx-mail-client component where CR (\r) and LF (\n) characters in user-supplied email header names, values, and MIME part metadata are not sanitized before being written into the SMTP DATA section. This allows injection of arbitrary headers or message content manipulation via methods such as MailMessage.addHeader(), MailMessage.setHeaders(), MailAttachment.addHeader(), MailAttachment.setHeaders(), and MIME part metadata setters. Additionally, a secondary weakness allows a bare LF in a From display-name to bypass encoding and be sent unchanged. An unauthenticated attacker able to control these inputs can exploit this to redirect email copies, spoof headers, or tamper with message structure. The affected component is io.vertx:vertx-mail-client. No official patch or fix information is provided in the source data.

An unauthenticated attacker who can control email header names, values, or attachment metadata fields can inject arbitrary SMTP headers or manipulate the MIME message structure. This can lead to email redirection, header spoofing, or tampering with the email content. The vulnerability affects the integrity and authenticity of outgoing emails sent via the vertx-mail-client component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid accepting untrusted input for email headers or attachment metadata fields in applications using the vertx-mail-client. Implement input validation or sanitization at the application level to prevent CR/LF injection in email headers.