Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-102479

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x…

Risk score
41/100
CVSS
5.9 v3.1
Exploit chance (30 days)
0.3%
Published
14 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length. T…
Affected
Eclipse Vert.x
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Eclipse Vert.xTHE FLAWSTHE FIXCVE-2026-102479In Eclipse Vert.x versions[5.0.0,5.0.12] or [5.1.0,5.1.9] or[5.2.0, 5.2.0], the Vert.x…CVSS 5.9 · EPSS 0%CVE-2026-103223Denial of serviceCVSS 5.9 · EPSS 0%CVE-2026-102465Denial of serviceCVSS 5.9 · EPSS 0%CVE-2026-102469Unsafe deserialisation can leadto remote code executionCVSS 5.9 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedEclipse Vert.xYELLOW · PLAN IT INEclipse Vert.xIn Eclipse Vert.x versions[4.0.0, 4.5.34] or [5.0.0,5.0.12]or [5.1.0,5.1.9] or [5.2.0, 5.2.0],the PostgreSQL messagedecoder reads the 4-bytemessage length field from thePostgreSQL wire protocol…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-444 (CWE-444)30 other warnings in 30 days →Same productEarlier Eclipse Vert.x warnings11 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Eclipse Vert.x: Yellow, plan it in. In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message hea…

The flaws

  • CVE-2026-102479: In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x… (CVSS 5.9 · EPSS 0%)
  • CVE-2026-103223: Denial of service (CVSS 5.9 · EPSS 0%)
  • CVE-2026-102465: Denial of service (CVSS 5.9 · EPSS 0%)
  • CVE-2026-102469: Unsafe deserialisation can lead to remote code execution (CVSS 5.9 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Eclipse Vert.x

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.9 medium

References

Original description

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length. This can be exploited for request smuggling purpose. The impacted component is io.vertx:vertx-core.

Last activity 14 Oct 2026. Patch Forecast updates every hour.