In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or… (CVE-2026-102471)

In Eclipse Vert.x vertx-mail-client versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0, the client fails to sanitize carriage return (CR) and line feed (LF) characters in user-supplied email header names and values before writing them into the SMTP DATA section. This allows an attacker who can control header names, values, or attachment metadata fields to inject arbitrary SMTP headers (such as Bcc, Reply-To, Content-Type) or prepend body content to outgoing messages. The vulnerability also affects MIME part metadata set via MailAttachment methods, which are written directly into MIME headers without validation. Additionally, a secondary weakness in the encoding function allows bare LF characters in From display-names to bypass Q-encoding and be sent unchanged. Exploitation requires unauthenticated control over input to the mail client, for example through a web form or API feeding into MailMessage. The affected component is io.vertx:vertx-mail-client.

An unauthenticated attacker able to supply header names, values, or attachment metadata to the vertx-mail-client can inject arbitrary SMTP headers or alter the message structure. This can lead to email redirection, header spoofing, or message tampering. The vulnerability does not impact confidentiality or integrity of the mail client itself but can disrupt email delivery and trust. The CVSS score of 5.9 reflects a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and unchanged confidentiality and integrity but high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or validate user input that is passed to the vertx-mail-client's header and attachment metadata fields to prevent injection of CR or LF characters. Avoid exposing mail client interfaces that accept arbitrary header or attachment metadata from untrusted sources.