Eclipse Vert.x: Incomplete SSL context cache key allows weaker TLS settings

Summary

The Vert.x HTTP client caches SSL contexts, but the cache key does not fully reflect all SSL settings. A client can therefore receive an SSL context with weaker properties than requested, for example one that ignores hostname validation. An attacker who can intercept the affected TLS connections could then impersonate a server, and the impact is limited to confidentiality and integrity of that connection. The vulnerability affects the io.vertx:vertx-core library, which is typically embedded in Java applications rather than run as a standalone product.

Affected

• io.vertx:vertx-core 5.0.0 to 5.0.12 (CNA data)
• io.vertx:vertx-core 5.1.0 to 5.1.9 (CNA data; GHSA lists 5.1.0 to 5.1.8)
• io.vertx:vertx-core 5.2.0 (GHSA lists 5.2.0; CNA data marks 5.2.0 as affected)
• Note: the sources differ on the exact ranges; verify against the vendor advisory.

Fixed in

• 5.1 line: 5.1.10 (per GHSA-2vhw-4xwj-r38v)
• 5.2 line: 5.2.1 (per GHSA-2vhw-4xwj-r38v); 5.2.2 is recommended by a secondary source because 5.2.1 reportedly has a regression
• 5.0 line: Unknown. No confirmed fixed 5.0.x version was found.

Workaround

Unknown. No vendor workaround was found. Upgrading is the realistic remedy.

Exploitation

• Not listed in CISA KEV; no known exploitation in the wild.
• No public proof-of-concept exploit is known.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS: 0.00226.

Our recommendation

• Check whether vertx-core is used directly or through third-party Java software, and identify the exact version in each JAR or dependency tree.
• Upgrade to 5.1.10 or later on the 5.1 line, and to 5.2.1 or later (5.2.2 preferred) on the 5.2 line. For the 5.0 line, check the vendor advisory for a fixed version.
• If an upgrade is delayed, review which HTTP clients use different TLS and hostname-verification settings within the same JVM, and make sure hostname verification is enforced where required.
• Note that vulnerability scanners may report false positives because the NVD CPE is generic; confirm the real vertx-core version.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-2vhw-4xwj-r38v github.com
• Eclipse CVE assignment work item #350 gitlab.eclipse.org
• Upstream fix pull request #6404 github.com
• Besu upgrade pull request #11770 (fixed versions) github.com
• VulDB entry 420290 vuldb.com
• OpenCVE CVE-2026-102476 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:35.