CVE-2026-102479: Vulnerability in Eclipse Foundation Eclipse Vert.x

The vulnerability in Eclipse Vert.x's HTTP/1.x decoder arises from its canonicalization logic for well-known HTTP headers. Specifically, the decoder incorrectly interprets crafted headers that resemble standard headers, enabling an attacker to manipulate how HTTP requests are processed. This can lead to HTTP request smuggling, where an attacker sends a specially crafted request that is interpreted differently by front-end and back-end servers, potentially bypassing security controls or causing other malicious effects. The affected component is io.vertx:vertx-core, and the impacted versions are 5.0.0 to 5.0.12 inclusive, 5.1.0 to 5.1.9 inclusive, and exactly 5.2.0.

Successful exploitation allows an attacker to perform HTTP request smuggling, which can lead to bypassing security controls, unauthorized access, or other malicious activities depending on the environment. The CVSS 4.0 score is 8.7 (high severity), indicating a network attack vector with low complexity and no required privileges or user interaction, but with high impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the Eclipse Foundation advisories for updates and apply patches once available. Until then, consider mitigating HTTP request smuggling risks by using web application firewalls or reverse proxies that can detect and block such attacks.