CVE-2026-102476 Security feature bypass in Eclipse Vert.x
Attackers can bypass SSL hostname validation in Eclipse Vert.x HTTP client due to improper SSL context caching, potentially enabling man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-102476?
CVE-2026-102476 is a critical vulnerability in Eclipse Vert.x, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation.
The impacted component is io.vertx:vertx-core.
Weakness: CWE-295
Which versions are affected by CVE-2026-102476?
How do I fix CVE-2026-102476?
No fix has been published for CVE-2026-102476 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-102476 being exploited?
There is no known exploitation of CVE-2026-102476 in the wild and no public exploit code.
Sources
Also known as GHSA-2vhw-4xwj-r38v.