CVE-2025-11966
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when directory listing is enabled, file and directory names are inserted into generated HTML without proper escaping in href, title, and link attributes. An attacker who can create or rename files in a served path can trigger stored XSS.
Risk Assessment
Users viewing an infected directory listing may fall victim to malicious script execution in their browser, potentially leading to session theft or other actions in the victim's context.
Recommendation
Update Eclipse Vert.x to version 4.5.22 or 5.0.5 (or later). If not possible, disable directory listing or restrict the ability to create and rename files in served directories.
Other vulnerabilities in Eclipse Vert.x
See all- CVE-2026-15075High
In Eclipse Vert.x up to versions 4.5.29 (4.x) and 5.1.4 (5.x), the DefaultRedirectHandler (vertx-core) forwards all request headers, including credential headers (Authorization, Cookie, Proxy-Authorization) and custom headers (e.g., X-API-Token), during cross-origin HTTP 30x redirects. No origin comparison (scheme, host, port) is performed before copying headers to the redirect target.
- CVE-2025-11965High
In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to hidden directories, allowing unauthorized users to retrieve files within them (e.g. '.git/config').
- CVE-2024-1300Medium
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. Attackers can send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
- CVE-2024-1023Medium
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. The leak occurs when the Vert.x HTTP client establishes connections to different hosts, and can be accelerated by an attacker with intimate runtime knowledge. A server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
Original NVD description (English source)
In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS