HTTP Header Canonicalization Flaw in Eclipse Vert.x
CVE-2026-102479

8.7HIGH

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Vert.x
Vendor
CVE Published:
14 October 2026

What is CVE-2026-102479?

Eclipse Vert.x versions 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 exhibit a vulnerability in their HTTP/1.x decoder. The canonicalization process misinterprets specifically crafted headers, such as 'Content-Xength' as 'Content-Length'. This flaw may enable malicious actors to execute request smuggling attacks, highlighting the need for immediate review and remediation of affected versions.

Affected Version(s)

Eclipse Vert.x 5.0.0 <= 5.0.12

Eclipse Vert.x 5.1.0 <= 5.1.9

Eclipse Vert.x 5.2.0

References

https://github.com/eclipse-vertx/vert.x/security/advisori...
https://gitlab.eclipse.org/security/cve-assignment/-/work...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mike Read
.