Eclipse Foundation Eclipse Vert.x
20 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-102477 | 4.0.0 – 4.5.34 ; 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; … | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable pe | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102464 | 4.0.0 – 4.5.34 ; 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; … | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttCl | HIGH 8.2 | 0.3 % | ||
| CVE-2026-102461 | 4.0.0 – 4.5.34 ; 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; … | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an | HIGH 8.7 | 0.4 % | ||
| CVE-2026-103224 | 4.0.0 – 4.5.34 ; 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; … | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inboun | HIGH 8.2 | 0.3 % | ||
| CVE-2026-103223 | 4.0.0 – 4.5.34 ; 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; … | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4- | HIGH 8.2 | 0.3 % | ||
| CVE-2026-102466 | 4.0.0 – 4.5.34 ; 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; … | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client | HIGH 8.2 | 0.3 % | ||
| CVE-2026-102463 | 4.0.0 – 4.5.34 ; 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; … | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client | HIGH 8.2 | 0.3 % | ||
| CVE-2026-102469 | 4.0.0 – 4.5.34 ; 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; … | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) co | CRITICAL 9.2 | 0.5 % | ||
| CVE-2026-102462 | 4.0.0 – 4.5.34 ; 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; … | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL | HIGH 8.2 | 0.3 % | ||
| CVE-2026-102465 | 4.0.0 – 4.5.34 ; 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; … | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-all | HIGH 8.2 | 0.2 % | ||
| CVE-2026-102475 | 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; 5.2.0 | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that re | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102467 | 4.0.0 – 4.5.34 ; 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; … | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not defin | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102471 | 4.0.0 – 4.5.34 ; 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; … | CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-102479 | 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; 5.2.0 | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well k | HIGH 8.7 | 0.3 % | ||
| CVE-2026-102460 | 4.0.0 – 4.5.34 ; 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; … | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Ecli | HIGH 8.6 | 0.3 % | ||
| CVE-2026-102476 | 5.0.0 – 5.0.12 ; 5.1.0 – 5.1.9 ; 5.2.0 | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency | CRITICAL 9.1 | 0.2 % | ||
| CVE-2026-15075 | 4.0.0 – 4.5.29 ; 5.0.0 – 5.1.4 | In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates al | HIGH 8.2 | 0.2 % | ||
| CVE-2026-15076 | 4.0.0 – 4.5.29 ; 5.0.0 – 5.1.4 | In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does | HIGH 8.2 | 0.2 % | ||
| CVE-2026-6860 | 4.3.4 – 4.5.26 ; 5.0.0 – 5.0.11 | A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name | MEDIUM 6.9 | 0.2 % | ||
| CVE-2024-8391 | 4.3.0 – < 4.5.10 | Eclipse Vert.x gRPC server does not limit the maximum message size | MEDIUM 6.9 | 0.6 % |