This vulnerability involves the TLS handshake process in Eclipse Vert.x, where the server accepts a server name extension that matches its wildcard certificate (e.g., *.example.com). A TCP client can present any valid subdomain under the wildcard, which the server will accept during TLS negotiation. This behavior could potentially be abused in scenarios relying on strict server name verification. The CVSS 4.0 base score is 6.9, indicating medium severity. Affected versions include 4.3.4 and 5.0.0. No remediation level or patch information is currently available.

The impact is that a client can present a server name matching the server's wildcard TLS certificate during handshake, which may lead to acceptance of connections under any subdomain covered by the wildcard. This could affect security assumptions about server identity verification in TLS connections. There are no known exploits in the wild, and the vulnerability does not require privileges or user interaction to be triggered.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Eclipse Foundation advisories for updates. No temporary or workaround fixes are documented at this time.