CVE-2026-102471

A moderate-impact CRLF injection flaw was found in the Eclipse Vert.x vertx-mail-client, which is shipped in the Red Hat Build of Quarkus 3. The vertx-mail-client does not sanitize CR and LF characters in user-supplied email header names and values, or in MIME part metadata such as content type, disposition, description, and content ID, before writing them into the SMTP DATA section. An unauthenticated remote attacker who can control any header name, header value, or attachment metadata field passed to the mail client, for example via a web form or API that feeds into MailMessage, can embed a CR/LF sequence to inject arbitrary email headers (such as Bcc, Reply-To, or Content-Type) or prepend body content to the outgoing message, allowing them to spoof message headers, tamper with email contents, and secretly redirect copies of outgoing email to unintended recipients. Red Hat rates this flaw Moderate severity with a CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). This differs from the upstream CVSS:3.1 assessment, which assigns no confidentiality impact: Red Hat includes a Low confidentiality impact because an injected Bcc header can silently copy outgoing messages to attacker-chosen recipients. Within the Red Hat Build of Quarkus, vertx-mail-client is affected in the quarkus-3 streams; the fix for the quarkus-3.33 stream is deferred because Red Hat does not file trackers for Moderate-severity flaws with a CVSS score below 7.0, leaving the residual risk of email header injection in applications that pass user-controlled data to the mail client until a fix is delivered. The quarkus-3.27 stream is out of support scope.