This can be exploited for request smuggling purpose.
The impacted component is io.vertx:vertx-core.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Vert.x | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 15 Oct 2026 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Vert.x HTTP/1.x Decoder Header Canonicalization Allows Request Smuggling | |
| Weaknesses | CWE-113 CWE-20 |
Wed, 14 Oct 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length. This can be exploited for request smuggling purpose. The impacted component is io.vertx:vertx-core. | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: eclipse
Published:
Updated: 2026-10-14T18:43:54.623Z
Reserved: 2026-09-29T08:57:24.202Z
Link: CVE-2026-102479
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-14T19:17:05.313
Modified: 2026-10-15T14:41:34.110
Link: CVE-2026-102479
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-15T13:45:19Z