CVE-2026-102476
Description
A flaw was found in Eclipse Vert.x. This vulnerability can lead to information disclosure because the HTTP client improperly caches Secure Sockets Layer (SSL) contexts. When requesting a secure connection, a client may inadvertently reuse a cached context configured with weaker security properties, such as disabled hostname validation. A remote attacker on the network path could exploit this flaw to bypass certificate validation and intercept or alter sensitive communications.
Statement
An IMPORTANT information disclosure flaw was found in the Eclipse Vert.x HTTP client (io.vertx:vertx-core). For efficiency, the Vert.x HTTP client caches SSL contexts, but the cache key does not fully capture the SSL semantics of the requested SSL properties. As a result, a client requesting an SSL context with strong security properties, such as hostname validation enabled, can receive a cached context with weaker properties, for example one that ignores hostname validation. A remote attacker positioned on the network path could exploit this flaw to bypass certificate validation and intercept or alter sensitive communications. Red Hat rates this flaw as IMPORTANT (CVSS 3.1 score 7.4) because exploitation requires high attack complexity: an on-path attacker must be able to trigger the reuse of a previously cached SSL context with weaker properties, and the flaw has no impact on availability. The upstream CVE record assigns a higher CRITICAL rating (CVSS 4.0 score 9.1) using a different CVSS version and metrics.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Vert.x project has released fixed versions of io.vertx:vertx-core (5.1.10 and 5.2.1); users of affected upstream releases should upgrade to a version containing the fix as described in the upstream advisory.
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
