CVE-2026-102479
Description
A flaw was found in Eclipse Vert.x. The HTTP/1.x decoder improperly canonicalizes standard HTTP header names, causing malformed headers such as Content-Xength to be misinterpreted as Content-Length. A remote attacker can exploit this flaw by sending crafted HTTP requests to perform HTTP request smuggling, potentially bypassing security boundaries or tampering with request routing.
Statement
An IMPORTANT severity flaw was found in Eclipse Vert.x, an upstream Java toolkit. The Vert.x HTTP/1.x decoder improperly canonicalizes well-known HTTP header names, so a crafted header such as Content-Xength can be interpreted as Content-Length. A remote, unauthenticated attacker could exploit this by sending crafted HTTP requests to a service built with the affected io.vertx:vertx-core component to perform HTTP request smuggling, potentially bypassing security boundaries or tampering with request routing. Red Hat rates this flaw as IMPORTANT, with a CVSS 3.1 base score of 7.5, while the CVEORG record assigns a CVSS 4.0 base score of 8.7; the difference reflects the different CVSS versions used rather than a materially different view of the vulnerability. At the time of this assessment, no Red Hat products have been identified as affected, as the vulnerable component, the upstream Maven artifact io.vertx:vertx-core, is not known to be shipped in any Red Hat offering.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Integrity,Non-Repudiation,Access Control
Technical Impact: Unexpected State; Hide Activities; Bypass Protection Mechanism
An attacker could create HTTP messages to exploit a number of weaknesses including 1) the message can trick the web server to associate a URL with another URL's webpage and caching the contents of the webpage (web cache poisoning attack), 2) the message can be structured to bypass the firewall protection mechanisms and gain unauthorized access to a web application, and 3) the message can invoke a script or a page that returns client credentials (similar to a Cross Site Scripting attack).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
