TLS Handshake Vulnerability in Eclipse Vert.x by Eclipse Foundation

CVE-2026-6860

What is CVE-2026-6860?

A vulnerability in Eclipse Vert.x allows a TCP client to successfully perform a TLS handshake by presenting a server name extension that can match any server wildcard name. This means that a server configured to accept a wildcard certificate, such as *.example.com, can be misled by clients using subdomains like XYZ.example.com, potentially exposing sensitive operations to unauthorized entities. This misconfiguration could allow for man-in-the-middle attacks or data interception, necessitating immediate attention to server certificate settings and validation mechanisms.

References