Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification.
Priority LOW 39CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.
Summary
Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need to provide a CSRF token in the request because the framework does not consider it. The cookies are automatically sent by the browser and the verification will always succeed, leading to a successful CSRF attack.
Why it matters now
EPSS 0.00587 48th percentileScored 2026-11-07
Fix Fixed io.vertx:vertx-web (Maven): 4.0.0-milestone5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | io.vertx:vertx-web (Maven) | 4.0.0-milestone1 to before 4.0.0-milestone5 | 4.0.0-milestone5 | Patch available | GHSA-9q69-g5gc-9fgf |
| — | io.vertx:vertx-web (Maven) | 4.0.0-milestone2 to before 4.0.0-milestone5 | 4.0.0-milestone5 | Patch available | GHSA-9q69-g5gc-9fgf |
| — | io.vertx:vertx-web (Maven) | 4.0.0-milestone3 to before 4.0.0-milestone5 | 4.0.0-milestone5 | Patch available | GHSA-9q69-g5gc-9fgf |
| — | io.vertx:vertx-web (Maven) | 4.0.0-milestone4 to before 4.0.0-milestone5 | 4.0.0-milestone5 | Patch available | GHSA-9q69-g5gc-9fgf |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- io.vertx:vertx-web (Maven) Vendor— Affected 4.0.0-milestone1 to before 4.0.0-milestone5 Fixed in 4.0.0-milestone5 Patch available GHSA-9q69-g5gc-9fgf
- io.vertx:vertx-web (Maven) Vendor— Affected 4.0.0-milestone2 to before 4.0.0-milestone5 Fixed in 4.0.0-milestone5 Patch available GHSA-9q69-g5gc-9fgf
- io.vertx:vertx-web (Maven) Vendor— Affected 4.0.0-milestone3 to before 4.0.0-milestone5 Fixed in 4.0.0-milestone5 Patch available GHSA-9q69-g5gc-9fgf
- io.vertx:vertx-web (Maven) Vendor— Affected 4.0.0-milestone4 to before 4.0.0-milestone5 Fixed in 4.0.0-milestone5 Patch available GHSA-9q69-g5gc-9fgf
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:vert.x-web:4.0.0:milestone1:*:*:*:*:*:* | 4.0.0 milestone1 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:vert.x-web:4.0.0:milestone2:*:*:*:*:*:* | 4.0.0 milestone2 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:vert.x-web:4.0.0:milestone3:*:*:*:*:*:* | 4.0.0 milestone3 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:vert.x-web:4.0.0:milestone4:*:*:*:*:*:* | 4.0.0 milestone4 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:vert.x-web:4.0.0:milestone1:*:*:*:*:*:* Versions 4.0.0 milestone1 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:vert.x-web:4.0.0:milestone2:*:*:*:*:*:* Versions 4.0.0 milestone2 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:vert.x-web:4.0.0:milestone3:*:*:*:*:*:* Versions 4.0.0 milestone3 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:vert.x-web:4.0.0:milestone4:*:*:*:*:*:* Versions 4.0.0 milestone4 Vulnerable ·Eclipse Foundation
Remediation
- Fix · GHSA-9q69-g5gc-9fgf io.vertx:vertx-web (Maven) Fixed in 4.0.0-milestone5 Advisory →
- Fix · GHSA-9q69-g5gc-9fgf io.vertx:vertx-web (Maven) Fixed in 4.0.0-milestone5 Advisory →
- Fix · GHSA-9q69-g5gc-9fgf io.vertx:vertx-web (Maven) Fixed in 4.0.0-milestone5 Advisory →
- Fix · GHSA-9q69-g5gc-9fgf io.vertx:vertx-web (Maven) Fixed in 4.0.0-milestone5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 6 products
- Red Hat Integration Camel K 1
- Red Hat Integration Service Registry
- Red Hat OpenShift Application Runtimes
- Red Hat build of Quarkus
- Red Hat support for Spring Boot
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2020-35217
- 2026-10-03 Alias added: GHSA-9q69-g5gc-9fgf
References
More Eclipse Foundation Vert.x-web vulnerabilities
- TI-2026-00756 Eclipse Vert.x Web static handler file access denial CVSS 4.0MEDIUM 6.9
- TI-2023-10315 Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web CVSS 3.1MEDIUM 5.3
Sources
- CVE-2020-35217 · CVE Program
- CVE-2020-35217 · NVD
- FIRST EPSS
- GHSA-9q69-g5gc-9fgf · GitHub Advisory Database · CC BY 4.0
- CVE-2020-35217 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences