This vulnerability in Eclipse Vert.x affects versions 4.3.4 and 5.0.0. It allows a TCP client to initiate a TLS handshake and present a server name extension that matches a server's wildcard certificate (e.g., *.example.com), causing the server to accept any valid subdomain under that wildcard. This is a weakness in the validation of the server name during the TLS handshake process, classified under CWE-295 (Improper Certificate Validation). The CVSS 4.0 base score is 6.9, indicating a medium severity level. The vulnerability is publicly known but no vendor remediation or patch has been published yet.

The impact is that a client can present a server name in the TLS handshake that matches a wildcard certificate accepted by the server, potentially allowing unintended subdomain acceptance. This could lead to trust or authentication issues in TLS connections relying on strict server name validation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be aware of this validation weakness and consider additional TLS validation controls or network-level mitigations if possible. Monitor vendor communications for updates on patches or official mitigations.