---
id: CVE-2026-102476
title: >-
  In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],
  the Vert.x HTTP client relies on an SSL context for efficiency purpose, the
  key of this cache should reflect entirely the SSL semantics of the desired SSL
  prop…
summary: >-
  In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],
  the Vert.x HTTP client relies on an SSL context for efficiency purpose, the
  key of this cache should reflect entirely the SSL semantics of the desired SSL
  prop…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-295
vendor: Eclipse Foundation
product: Eclipse Vert.x
affected:
  - eclipse_vert.x >= 5.0.0 <= 5.0.12
  - eclipse_vert.x >= 5.1.0 <= 5.1.9
  - eclipse_vert.x 5.2.0
published: '2026-10-14'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:17:00.993'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102476'
references:
  - url: >-
      https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-2vhw-4xwj-r38v
    label: emo@eclipse.org
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/350'
    label: emo@eclipse.org
tags:
  - nvd
  - cve.org
epss: 0.00226
epssPercentile: 0.13265
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:18:33.378871Z'
cvssSource: cna
ingestedAt: '2026-10-14T18:47:39.306Z'
---

## Overview

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation.



The impacted component is io.vertx:vertx-core.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.