Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-102471

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0]…

Risk score
40/100
CVSS
5.9 v3.1
Exploit chance (30 days)
0.3%
Published
14 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value passed to Ma…
Affected
Eclipse Vert.x
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Eclipse Vert.xTHE FLAWSTHE FIXCVE-2026-102471In Eclipse Vert.x versions[4.0.0, 4.5.34] or [5.0.0,5.0.12]or [5.1.0,5.1.9] or [5.2.0, 5.2.0]…CVSS 5.9 · EPSS 0%CVE-2026-103223Denial of serviceCVSS 5.9 · EPSS 0%CVE-2026-102465Denial of serviceCVSS 5.9 · EPSS 0%CVE-2026-102469Unsafe deserialisation can leadto remote code executionCVSS 5.9 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedEclipse Vert.xYELLOW · PLAN IT INEclipse Vert.xIn Eclipse Vert.x versions[4.0.0, 4.5.34] or [5.0.0,5.0.12]or [5.1.0,5.1.9] or [5.2.0, 5.2.0],the PostgreSQL messagedecoder reads the 4-bytemessage length field from thePostgreSQL wire protocol…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-93 (CWE-93)21 other warnings in 30 days →Same productEarlier Eclipse Vert.x warnings11 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Eclipse Vert.x: Yellow, plan it in. In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message hea…

The flaws

  • CVE-2026-102471: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0]… (CVSS 5.9 · EPSS 0%)
  • CVE-2026-103223: Denial of service (CVSS 5.9 · EPSS 0%)
  • CVE-2026-102465: Denial of service (CVSS 5.9 · EPSS 0%)
  • CVE-2026-102469: Unsafe deserialisation can lead to remote code execution (CVSS 5.9 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Eclipse Vert.x

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.9 medium

References

Original description

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value passed to MailMessage.addHeader(), MailMessage.setHeaders(), MailAttachment.addHeader(), or MailAttachment.setHeaders() is written verbatim to the wire, allowing an attacker to inject arbitrary headers (e.g. Bcc, Reply-To, Content-Type) or prepend body content to the outgoing message. The same weakness affects MIME part metadata set via MailAttachment.setContentType(), setDisposition(), setDescription(), and setContentId(), which are written directly into MIME part headers without validation. A secondary weakness in Utils.mustEncode(char) additionally allows a bare LF in a From display-name to bypass Q-encoding and reach the wire unchanged. An unauthenticated attacker who can control any header name, header value, or attachment metadata field passed to the mail client (for example via a web form or API that feeds into MailMessage) can exploit this to redirect email copies, spoof headers, or tamper with message structure. The impacted component is io.vertx:vertx-mail-client.

Last activity 14 Oct 2026. Patch Forecast updates every hour.