io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation

A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4.SP3 security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

CVE-2026-15076

In versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacke...

com.datasqrl:sqrl-discovery (>=0.9.0, <=0.10.8), com.datasqrl:sqrl-planner (>=0.9.0, <=0.10.8) +232 more potentially affected by CVE-2026-15076 via io.vertx:vertx-web-client (>=5.0.0, <=5.1.4)

io.vertx:vertx-web-client MAVEN version =5.0.0, =0.9.0, =0.9.0, =0.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.0, =2.0.0-rc9, =2.1.0 - com.guicedee:service-registry 2.1.0 - com.romanpierson:vertx-elasticsearch-indexer 2.3.0 and more Source cves: CVE-2026-15076 Source advisory:...