SB20261110269 - Multiple vulnerabilities in Vert.x

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110269

SB20261110269 - Multiple vulnerabilities in Vert.x

Published: November 10, 2026

Security Bulletin ID SB20261110269
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Improper handling of highly compressed data (CVE-ID: CVE-2026-102467)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through excessive memory consumption.

The vulnerability exists due to missing memory allocation limits in the Vert.x WebSocket implementation when decompressing frames or messages. A remote attacker can send compressed WebSocket frames or messages containing a zip bomb to exhaust memory and disrupt service.


2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-102479)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to smuggle HTTP requests and compromise request integrity.

The vulnerability exists due to incorrect header canonicalization in the Vert.x HTTP/1.x decoder when processing crafted HTTP headers. A remote attacker can send requests containing Content-Xength headers that are incorrectly interpreted as Content-Length to manipulate request boundaries and smuggle requests.


3) Improper Certificate Validation (CVE-ID: CVE-2026-102476)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to impersonate servers and compromise the confidentiality and integrity of HTTPS traffic.

The vulnerability exists due to an incomplete cache key in the Vert.x HTTP client's SSL context cache when retrieving contexts with different SSL security properties. A remote attacker can exploit reuse of a weaker context that ignores hostname validation to impersonate a server and read or modify HTTPS traffic.


Remediation

Install update from vendor's website.

References