Improper input validation in Eclipse Vert.x
Priority LOW 29CWE-93Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
Why it matters now
EPSS 0.02482 84th percentileScored 2026-11-07
Fix Fixed io.vertx:vertx-core (Maven): 3.5.2Red Hat: 2 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Vert.x | 3.0 and later; up to 3.5.1 | — | No fix listed | CNA |
| — | io.vertx:vertx-core (Maven) | 3.0.0 to before 3.5.2 | 3.5.2 | Patch available | GHSA-6cw8-7j6c-hccp |
- Eclipse Vert.x VendorEclipse Foundation Affected 3.0 and later; up to 3.5.1 Fixed in — No fix listed CNA
- io.vertx:vertx-core (Maven) Vendor— Affected 3.0.0 to before 3.5.2 Fixed in 3.5.2 Patch available GHSA-6cw8-7j6c-hccp
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* | 3.0.0 – 3.5.1 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.5.1 Vulnerable ·Eclipse Foundation
Remediation
- Fix · GHSA-6cw8-7j6c-hccp io.vertx:vertx-core (Maven) Fixed in 3.5.2 Advisory →
Red Hat 2 advisories
- RHSA-2018:3768 Released 2018-12-04 · Red Hat rating ImportantRed Hat Fuse 7.2 security update
- Red Hat Fuse 7.2
- RHSA-2018:2371 Released 2018-08-09 · Red Hat rating ModerateRed Hat OpenShift Application Runtimes security and bug fix update
- Text-Only RHOAR
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7.2 | Fixed | RHSA-2018:3768 |
| Text-Only RHOAR | Fixed | RHSA-2018:2371 |
Not affected: 1 product
- Red Hat JBoss Fuse 6
Timeline
- 2026-10-02 Threatist record created from CVE-2018-12537
- 2026-10-03 Alias added: GHSA-6cw8-7j6c-hccp
References
Advisory 9
- https://github.com/eclipse/vert.x/commit/1bb6445226c39a95e7d07ce3caaf56828e8aab72
- https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-021_vertx.txt
- RHSA-2018:2371
- https://github.com/eclipse/vert.x/issues/2470
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=536038
- RHSA-2018:3768
- https://bugzilla.redhat.com/show_bug.cgi?id=1591072
- https://nvd.nist.gov/vuln/detail/CVE-2018-12537
- https://github.com/advisories/GHSA-6cw8-7j6c-hccp
More Eclipse Foundation Vert.x vulnerabilities
- TI-2026-06017 Improper certificate validation in Eclipse Vert.x CVSS 4.0MEDIUM 6.9
- TI-2025-10971 In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler… CVSS 4.0MEDIUM 6.3
- TI-2019-13165 Path traversal in Eclipse Vert.x CVSS 3.1CRITICAL 9.8
- TI-2018-09003 XML external entity injection in Eclipse Vert.x CVSS 3.0CRITICAL 9.8
- TI-2018-09001 Path traversal in Eclipse Vert.x CVSS 3.0CRITICAL 9.8
- TI-2025-10972 Cross-site scripting in Eclipse Foundation Vert.x CVSS 4.0LOW 2.3
Sources
- CVE-2018-12537 · CVE Program
- CVE-2018-12537 · NVD
- FIRST EPSS
- GHSA-6cw8-7j6c-hccp · GitHub Advisory Database · CC BY 4.0
- CVE-2018-12537 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences