---
id: CVE-2026-102476
title: >-
  In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],
  the Vert.x HTTP client relies on an SSL context for efficiency purpose, the
  key of this cache should reflect entirely the SSL semantics of the desired SSL
  prop…
summary: >-
  In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],
  the Vert.x HTTP client relies on an SSL context for efficiency purpose, the
  key of this cache should reflect entirely the SSL semantics of the desired SSL
  prop…
severity: none
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T18:17:17.503'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102476'
references:
  - url: >-
      https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-2vhw-4xwj-r38v
    label: emo@eclipse.org
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/350'
    label: emo@eclipse.org
tags:
  - nvd
ingestedAt: '2026-10-14T18:47:39.306Z'
---

## Overview

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation.



The impacted component is io.vertx:vertx-core.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.