CVE-2026-102476

{
  "etk_id": "ETK-2026-964",
  "cve_id": "CVE-2026-102476",
  "display_id": "CVE-2026-102476",
  "ghsa_id": "GHSA-2vhw-4xwj-r38v",
  "euvd_id": "EUVD-2026-101530",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SSL context cache confusion in Vert.x HTTP client",
  "summary": "Vert.x Core HTTP clients in affected 5.x releases can reuse an SSL context with weaker TLS settings than the requesting client expects. An attacker able to interfere with TLS connections may benefit when a request that requires hostname validation receives a cached context that does not enforce it; this requires use of differing SSL configurations that trigger the incorrect cache reuse.",
  "mitigation": "Upgrade io.vertx:vertx-core to 5.1.10 or 5.2.1, as appropriate for the maintained release line. Until upgraded, avoid sharing HTTP-client SSL contexts across configurations with different TLS validation requirements.",
  "vendor": "maven",
  "product": "maven:io.vertx:vertx-core",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0, <= 5.1.8"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "5.1.10"
      ],
      "package_name": "io.vertx:vertx-core",
      "purl": "pkg:maven/io.vertx/vertx-core"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "5.2.0"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "5.2.1"
      ],
      "package_name": "io.vertx:vertx-core",
      "purl": "pkg:maven/io.vertx/vertx-core"
    }
  ],
  "cwes": null,
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0023,
  "epss_percentile": 0.1261,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 17.408460266666665,
  "t0_at": "2026-10-14T18:11:45.277000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T21:52:58+00:00",
      "days": -6.846380520833334,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T18:11:45.277000+00:00",
      "url": "https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-2vhw-4xwj-r38v"
    }
  }
}