CVE-2026-6860 Vert.x has a DoS via unbounded server-side SNI SslContext cache growth
Attackers can bypass TLS hostname verification by using wildcard certificates, allowing man-in-the-middle attacks against Eclipse Vert.x applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6860?
CVE-2026-6860 is a medium-severity vulnerability in Eclipse Vert.x, published on 6 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting *.example.com, any XYZ.example.com where xyz is a valid name can be used.
Which versions are affected by CVE-2026-6860?
8 open source packages ship an affected version, including io.vertx:vertx-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.vertx:vertx-core Maven | From 4.3.4 to 4.3.8 | None |
io.vertx:vertx-core Maven | From 4.3.4 to 4.3.8 | None |
io.vertx:vertx-core Maven | From 4.4.0 to 4.4.9 | None |
io.vertx:vertx-core Maven | From 4.4.0 to 4.4.9 | None |
io.vertx:vertx-core Maven | From 4.5.0 | 4.5.27 |
io.vertx:vertx-core Maven | From 4.5.0 | 4.5.27 |
2 more packages
io.vertx:vertx-core Maven | From 5.0.0 | 5.0.12 |
io.vertx:vertx-core Maven | From 5.0.0 | 5.0.12 |
Products include Eclipse Vert.x.
How do I fix CVE-2026-6860?
Upgrade io.vertx:vertx-core to a fixed version for your release line: 4.5.27 or 5.0.12.
Is CVE-2026-6860 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6860 exists.
Other vulnerabilities in Eclipse Vert.x
- CVE-2019-17640 Path Traversal in Eclipse Vert
- CVE-2018-12542 Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location
- CVE-2018-12544 Moderate severity vulnerability that affects io.vertx:vertx-core
- CVE-2026-102469 Deserialization in Eclipse Vert.x
- CVE-2018-12540 High severity vulnerability that affects io.vertx:vertx-web
Sources
Also known as CLEANSTART-2026-EB50252, CLEANSTART-2026-FU49566, CLEANSTART-2026-TN22845, ECHO-0737-9682-1591, GHSA-3g76-f9xq-8vp6, MINI-2p7r-cmfx-3pqm and 27 more.