Improper certificate validation in Eclipse Vert.x
Priority HIGH 70CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Spoofing, Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 10 fixed, 15 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295 and CWE-770.
Summary
A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting *.example.com, any XYZ.example.com where xyz is a valid name can be used.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00238 14th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial io.vertx:vertx-core (Maven): 4.5.27, 5.0.12Red Hat: 10 advisoriesRed Hat: 10 fixed, 15 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Vert.x | 4.3.4 – 4.5.26; 5.0.0 – 5.0.11 | — | No fix listed | CNA |
| — | io.vertx:vertx-core (Maven) | 4.3.4 – 4.3.8 | — | No fix listed | GHSA-3g76-f9xq-8vp6 |
| — | io.vertx:vertx-core (Maven) | 4.4.0 – 4.4.9 | — | No fix listed | GHSA-3g76-f9xq-8vp6 |
| — | io.vertx:vertx-core (Maven) | 4.5.0 to before 4.5.27 | 4.5.27 | Patch available | GHSA-3g76-f9xq-8vp6 |
| — | io.vertx:vertx-core (Maven) | 5.0.0 to before 5.0.12 | 5.0.12 | Patch available | GHSA-3g76-f9xq-8vp6 |
- Eclipse Vert.x VendorEclipse Foundation Affected 4.3.4 – 4.5.26; 5.0.0 – 5.0.11 Fixed in — No fix listed CNA
- io.vertx:vertx-core (Maven) Vendor— Affected 4.3.4 – 4.3.8 Fixed in — No fix listed GHSA-3g76-f9xq-8vp6
- io.vertx:vertx-core (Maven) Vendor— Affected 4.4.0 – 4.4.9 Fixed in — No fix listed GHSA-3g76-f9xq-8vp6
- io.vertx:vertx-core (Maven) Vendor— Affected 4.5.0 to before 4.5.27 Fixed in 4.5.27 Patch available GHSA-3g76-f9xq-8vp6
- io.vertx:vertx-core (Maven) Vendor— Affected 5.0.0 to before 5.0.12 Fixed in 5.0.12 Patch available GHSA-3g76-f9xq-8vp6
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* | 4.3.4 – 4.5.26; 5.0.0 – 5.0.11 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* Versions 4.3.4 – 4.5.26; 5.0.0 – 5.0.11 Vulnerable ·Eclipse Foundation
Remediation
- Fix · GHSA-3g76-f9xq-8vp6 io.vertx:vertx-core (Maven) Fixed in 4.5.27 Advisory →
- Fix · GHSA-3g76-f9xq-8vp6 io.vertx:vertx-core (Maven) Fixed in 5.0.12 Advisory →
Red Hat 10 advisories
- RHSA-2026:54622 Released 2026-08-13 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.18.3 for Spring Boot release.
- Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
- RHSA-2026:54435 Released 2026-08-12 · Red Hat rating ImportantStreams for Apache Kafka 3.2.1 release and security update
- Streams for Apache Kafka 3.2.1
- RHSA-2026:48151 Released 2026-07-29 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
Show 7 more Red Hat advisories
- RHSA-2026:34608 Released 2026-07-02 · Red Hat rating ImportantStreams for Apache Kafka 2.9.4 release and security update
- Streams for Apache Kafka 2.9.4
- RHSA-2026:30084 Released 2026-06-25 · Red Hat rating ImportantRed Hat build of Keycloak 26.6.4 Images Security Update
- Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
- RHSA-2026:30083 Released 2026-06-25 · Red Hat rating ImportantRed Hat build of Keycloak 26.6.4 Security Update
- Red Hat build of Keycloak 26.6.4
- RHSA-2026:30050 Released 2026-06-25 · Red Hat rating ImportantRed Hat build of Keycloak 26.4.13 Images Security Update
- Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
- RHSA-2026:30049 Released 2026-06-25 · Red Hat rating ImportantRed Hat build of Keycloak 26.4.13 Security Update
- Red Hat build of Keycloak 26.4.13
- RHSA-2026:26018 Released 2026-06-17 · Red Hat rating ImportantRed Hat build of Quarkus 3.27.4.SP1 security update
- Red Hat build of Quarkus 3.27.4.SP1 io.netty.netty-codec-haproxy-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.135.Final-redhat-00001.jar +4
- RHSA-2026:26017 Released 2026-06-17 · Red Hat rating ImportantRed Hat build of Quarkus 3.33.2.SP1 security update
- Red Hat build of Quarkus 3.33.2.SP1 io.netty.netty-codec-haproxy-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.135.Final-redhat-00001.jar +4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2026:48151 |
| Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16 | Fixed | RHSA-2026:54622 |
| Red Hat build of Keycloak 26.4 | Fixed | RHSA-2026:30050 |
| Red Hat build of Keycloak 26.4.13 | Fixed | RHSA-2026:30049 |
| Red Hat build of Keycloak 26.6 | Fixed | RHSA-2026:30084 |
| Red Hat build of Keycloak 26.6.4 | Fixed | RHSA-2026:30083 |
| Red Hat build of Quarkus 3.27.4.SP1 | Fixed | RHSA-2026:26018 |
| Red Hat build of Quarkus 3.33.2.SP1 | Fixed | RHSA-2026:26017 |
| Streams for Apache Kafka 2.9.4 | Fixed | RHSA-2026:34608 |
| Streams for Apache Kafka 3.2.1 | Fixed | RHSA-2026:54435 |
Not affected: 3 products
- Cryostat 4 on RHEL 9
- Red Hat build of Quarkus 3.27.4.SP1
- Red Hat build of Quarkus 3.33.2.SP1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-6860
- 2026-10-03 Alias added: GHSA-3g76-f9xq-8vp6
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
References
Exploit 2
More Eclipse Foundation Vert.x vulnerabilities
- TI-2025-10971 In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler… CVSS 4.0MEDIUM 6.3
- TI-2019-13165 Path traversal in Eclipse Vert.x CVSS 3.1CRITICAL 9.8
- TI-2018-09003 XML external entity injection in Eclipse Vert.x CVSS 3.0CRITICAL 9.8
- TI-2018-09001 Path traversal in Eclipse Vert.x CVSS 3.0CRITICAL 9.8
- TI-2025-10972 Cross-site scripting in Eclipse Foundation Vert.x CVSS 4.0LOW 2.3
- TI-2026-74673 Compression bomb in Eclipse Vert.x gRPC server CVSS 4.0HIGH 8.7
Sources
- CVE-2026-6860 · CVE Program
- CVE-2026-6860 · NVD
- FIRST EPSS
- GHSA-3g76-f9xq-8vp6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-6860 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences