io.smallrye.reactive:smallrye-mutiny-vertx-web-api-service (>=4.0.1, <=4.0.2), io.strimzi:kafka-bridge (>=1.1.0-rc1, <=1.1.0) +3 more potentially affected by CVE-2026-102461 via io.vertx:vertx-web-openapi-router (>=5.1.5, <=5.1.9)

io.vertx:vertx-web-openapi-router MAVEN version =5.1.5, =4.0.1, =1.1.0-rc1, =5.1.5, =5.1.5, =5.1.5, =5.1.9 Source cves: CVE-2026-102461 Source advisory: MEND:CVE-2026-102461...

com.artipie:artipie (>=v0.27.12, <=v0.30.1), com.datasqrl:sqrl-config (0.6.1) +22 more potentially affected by CVE-2026-102461 via io.vertx:vertx-web-validation (>=4.0.0, <=4.5.34)

io.vertx:vertx-web-validation MAVEN version =4.0.0, =v0.27.12, =3.1.0-rc1, =1.0.1, =0.11.0, =0.11.0, =2.13.0, =2.0.0.rc1, =2.0.0.rc1, =0.21.0, =0.32.0 and more Source cves: CVE-2026-102461 Source advisory: MEND:CVE-2026-102461...

cc.openxiot:resty (>=0.0.1, <=0.0.23), io.neonbee:neonbee-core (>=0.20.0, <=0.37.27) +4 more potentially affected by CVE-2026-102461 via io.vertx:vertx-web-openapi-router (>=4.4.0, <=4.5.34)

io.vertx:vertx-web-openapi-router MAVEN version =4.4.0, =0.0.1, =0.20.0, =0.20.0, =3.20.1, =4.4.0, =4.4.0, =4.5.34 Source cves: CVE-2026-102461 Source advisory: MEND:CVE-2026-102461...

dev.vertique:vertique-rest-openapi-validation (>=0.1.0, <=0.3.0), io.smallrye.reactive:smallrye-mutiny-vertx-web-api-service (>=4.0.1, <=4.0.2) +5 more potentially affected by CVE-2026-102461 via io.vertx:vertx-openapi (>=5.1.5, <=5.1.9)

io.vertx:vertx-openapi MAVEN version =5.1.5, =0.1.0, =4.0.1, =1.1.0-rc1, =5.1.5, =5.1.5, =5.1.5, =5.1.5, =5.1.9 Source cves: CVE-2026-102461 Source advisory: MEND:CVE-2026-102461...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +5289 more potentially affected by CVE-2026-102460 via io.vertx:vertx-web (>=4.0.0, <=4.5.34)

io.vertx:vertx-web MAVEN version =4.0.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91,...

CVE-2026-102460

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already...

CVE-2026-102460

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already...

CVE-2026-102460

Eclipse Vert.x Web (Maven coordinate io.vertx:vertx-web ) is vulnerable to a scope bypass in the ChainAuthHandler component. This affects versions [4.0.0, 4.5.34] , [5.0.0, 5.0.12] , [5.1.0, 5.1.9] , and [5.2.0, 5.2.0] . The root cause is that postAuthentication() relies on internal state establi...

CVE-2026-102460

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +3540 more potentially affected by CVE-2026-102460 via io.vertx:vertx-web (>=4.5.0, <=4.5.34)

io.vertx:vertx-web MAVEN version =4.5.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91,...

CVE-2026-102460

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already...

CVE-2026-102460: Incorrect Authorization

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already...

io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation

A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...

io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation

A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4.SP3 security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

CVE-2026-15076

In versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacke...

CVE-2026-15076

In versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacke...

com.datasqrl:sqrl-discovery (>=0.9.0, <=0.10.8), com.datasqrl:sqrl-planner (>=0.9.0, <=0.10.8) +232 more potentially affected by CVE-2026-15076 via io.vertx:vertx-web-client (>=5.0.0, <=5.1.4)

io.vertx:vertx-web-client MAVEN version =5.0.0, =0.9.0, =0.9.0, =0.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.0, =2.0.0-rc9, =2.1.0 - com.guicedee:service-registry 2.1.0 - com.romanpierson:vertx-elasticsearch-indexer 2.3.0 and more Source cves: CVE-2026-15076 Source advisory:...

Security Bulletin: IBM SPSS Analytic Server is affected by a Vert.x Web Static Handler cache manipulation vulnerability (CVE-2026-1002)

Summary IBM SPSS Analytic Server is affected by a Vert.x Web Static Handler cache manipulation vulnerability CVE-2026-1002. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-1002 DESCRIPTION: The Vert.x Web static handler component cache can be manipulated t...

Linux Distros Unpatched Vulnerability : CVE-2026-1002

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request UR...