Cross-site scripting in Eclipse Foundation Vert.x
Priority MEDIUM 45CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 3 fixed, 21 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Vert.x (Eclipse Foundation): 4.5.22, 5.0.5io.vertx:vertx-web (Maven): 4.5.22, 5.0.5Red Hat: 3 advisoriesRed Hat: 3 fixed, 21 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Vert.x | 4.0.0 to before 4.5.22; 5.0.0 to before 5.0.5 | 4.5.22, 5.0.5 | Patch available | CNA |
| — | io.vertx:vertx-web (Maven) | before 4.5.22 | 4.5.22 | Patch available | GHSA-45p5-v273-3qqr |
| — | io.vertx:vertx-web (Maven) | 5.0.0 to before 5.0.5 | 5.0.5 | Patch available | GHSA-45p5-v273-3qqr |
- Vert.x VendorEclipse Foundation Affected 4.0.0 to before 4.5.22; 5.0.0 to before 5.0.5 Fixed in 4.5.22, 5.0.5 Patch available CNA
- io.vertx:vertx-web (Maven) Vendor— Affected before 4.5.22 Fixed in 4.5.22 Patch available GHSA-45p5-v273-3qqr
- io.vertx:vertx-web (Maven) Vendor— Affected 5.0.0 to before 5.0.5 Fixed in 5.0.5 Patch available GHSA-45p5-v273-3qqr
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* | 4.0.0 to before 4.5.22; 5.0.0 to before 5.0.5 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.5.22; 5.0.0 to before 5.0.5 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA Vert.x (Eclipse Foundation) Fixed in 4.5.22, 5.0.5
- Fix · GHSA-45p5-v273-3qqr io.vertx:vertx-web (Maven) Fixed in 4.5.22 Advisory →
- Fix · GHSA-45p5-v273-3qqr io.vertx:vertx-web (Maven) Fixed in 5.0.5 Advisory →
Red Hat 3 advisories
- RHSA-2026:0134 Released 2026-01-06 · Red Hat rating ImportantRed Hat build of Quarkus 3.27.1.SP1 security update
- Red Hat build of Quarkus 3.27.1.SP1
- RHSA-2026:0131 Released 2026-01-06 · Red Hat rating ImportantRed Hat build of Quarkus 3.20.4.SP1 security update
- Red Hat build of Quarkus 3.20.4.SP1
- RHSA-2025:23417 Released 2025-12-16 · Red Hat rating ImportantStreams for Apache Kafka 3.1.0 release and security update
- Streams for Apache Kafka 3.1.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Eclipse Foundation Vert.x 4.5.22, 5.0.5
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2025-10971 In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler…Priority HIGH 67
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus 3.20.4.SP1 | Fixed | RHSA-2026:0131 |
| Red Hat build of Quarkus 3.27.1.SP1 | Fixed | RHSA-2026:0134 |
| Streams for Apache Kafka 3.1.0 | Fixed | RHSA-2025:23417 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-11966
- 2026-10-03 Alias added: GHSA-45p5-v273-3qqr
References
More Eclipse Foundation Vert.x vulnerabilities
- TI-2026-06017 Improper certificate validation in Eclipse Vert.x CVSS 4.0MEDIUM 6.9
- TI-2025-10971 In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler… CVSS 4.0MEDIUM 6.3
- TI-2019-13165 Path traversal in Eclipse Vert.x CVSS 3.1CRITICAL 9.8
- TI-2018-09003 XML external entity injection in Eclipse Vert.x CVSS 3.0CRITICAL 9.8
- TI-2018-09001 Path traversal in Eclipse Vert.x CVSS 3.0CRITICAL 9.8
- TI-2026-74673 Compression bomb in Eclipse Vert.x gRPC server CVSS 4.0HIGH 8.7
Sources
- CVE-2025-11966 · CVE Program
- CVE-2025-11966 · NVD
- FIRST EPSS
- GHSA-45p5-v273-3qqr · GitHub Advisory Database · CC BY 4.0
- CVE-2025-11966 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences