Improper Certificate Validation in Vert.x - CVE-2026-102476
Published: November 10, 2026
Vulnerability identifier: #VU164374
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102476
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to impersonate servers and compromise the confidentiality and integrity of HTTPS traffic.
The vulnerability exists due to an incomplete cache key in the Vert.x HTTP client's SSL context cache when retrieving contexts with different SSL security properties. A remote attacker can exploit reuse of a weaker context that ignores hostname validation to impersonate a server and read or modify HTTPS traffic.
Affected software
Vert.x
How to mitigate CVE-2026-102476
Install security update from vendor's website.
Vert.x - addressed in versions 5.1.10, 5.2.1