{"id":"CVE-2026-102476","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-102476","generatedAt":"2026-10-27T22:46:33.697Z","title":"It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation.","description":"In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation.\n\n\n\nThe impacted component is io.vertx:vertx-core.","published":"2026-10-14T18:17:18.000Z","lastModified":"2026-10-16T19:17:01.000Z","status":"Awaiting Analysis","sourceIdentifier":"emo@eclipse.org","cvss":{"version":"4.0","score":9.1,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-295"],"affected":[],"epss":{"score":0.00226,"percentile":0.1323,"date":"2026-10-26","history":[{"date":"2026-10-15","score":0.00239,"percentile":0.13872}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-14T18:17:18.000Z","detail":{"score":"9.1","severity":"CRITICAL","publishedAt":"2026-10-14T18:17:17.503Z"},"summary":"New CVE, critical severity (CVSS 9.1)."}],"references":[{"url":"https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-2vhw-4xwj-r38v","source":"emo@eclipse.org"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/350","source":"emo@eclipse.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102476","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}