Zero Radar
← feed
HighVulnerabilityCVE-2026-102479updated 28 Oct 2026, 21:17 UTC

Eclipse Vert.x HTTP server can be tricked by malformed headers

A typo-like change in a header name can make the server read one request differently than a proxy in front of it does. Attackers can use that gap to sneak hidden requests through to the server.

Official, 2 sources
SeverityHighCVSS 8.7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts requestSends a misspelled header like Content-Xength
  2. 2Vert.x misreads headerCanonicalization maps it to Content-Length
  3. 3Proxy and server disagreeEach sees request boundaries differently
  4. 4Smuggled request processedHidden request reaches the application
  5. ResultAttacker bypasses controls or hijacks requests

What happened

The HTTP/1.x decoder in Eclipse Vert.x (io.vertx:vertx-core) canonicalizes well-known header names, so a crafted header such as Content-Xength is interpreted as Content-Length, enabling HTTP request smuggling.

Why it is dangerous: Request smuggling can let an attacker bypass proxy or security controls, poison caches, or hijack other users' requests on shared connections. Applications built on vertx-core that sit behind a reverse proxy or load balancer are at risk.

Are you affected?

You are affected if you run io.vertx:vertx-core versions 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, or 5.2.0 directly or as a transitive dependency.

io.vertx:vertx-core 5.0.0 through 5.0.12; 5.1.0 through 5.1.9; 5.2.0

What to do

  1. Check your Maven or Gradle dependency tree for io.vertx:vertx-core and note the version.
  2. Upgrade vertx-core to a version fixed by the vendor advisory GHSA-ch7p-g5pm-3gqx; versions outside the affected ranges are not vulnerable.
  3. If you cannot upgrade yet, review the advisory for mitigations and restrict direct access to the app so only trusted proxies reach it.

Timeline

  1. 14 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 18:14 UTC
    Reported by oss-security · oss-security
  3. 28 Oct 2026, 18:16 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 21:17 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-102479
CVSS
8.7 / 10
Disclosed
14 Oct 2026, 19:17 UTC
On Zero Radar
28 Oct 2026, 18:16 UTC (14 days after disclosure)
Last change
28 Oct 2026, 21:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Eclipse Vert.x HTTP server can be tricked by malformed headers · Zero Radar