CVE-2026-15075
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In Eclipse Vert.x up to versions 4.5.29 (4.x) and 5.1.4 (5.x), the DefaultRedirectHandler (vertx-core) forwards all request headers, including credential headers (Authorization, Cookie, Proxy-Authorization) and custom headers (e.g., X-API-Token), during cross-origin HTTP 30x redirects. No origin comparison (scheme, host, port) is performed before copying headers to the redirect target.
Risk Assessment
An attacker who can cause a Vert.x HttpClient to issue a request redirected to an attacker-controlled host (e.g., via a URL to a webhook dispatcher, image proxy, or microservice URL fetcher) can capture bearer tokens, basic-auth credentials, session cookies, and API keys attached to the original request.
Recommendation
Immediately upgrade Eclipse Vert.x to version 4.5.30 or later (for 4.x branch) and 5.1.5 or later (for 5.x branch). As a temporary workaround, configure a custom redirect handler that strips sensitive headers before forwarding the request to an external destination.
Other vulnerabilities in Eclipse Vert.x
See all- CVE-2024-1300Medium
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. Attackers can send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
- CVE-2024-1023Medium
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. The leak occurs when the Vert.x HTTP client establishes connections to different hosts, and can be accelerated by an attacker with intimate runtime knowledge. A server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
Original NVD description (English source)
In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (scheme, host, port) is performed before copying headers to the redirect target. As a result, credential headers, including Authorization, Cookie, Proxy-Authorization, and arbitrary custom headers such as X-API-Token, are forwarded to the redirect destination without the caller's knowledge. An attacker who can cause a Vert.x HttpClient to issue a request that is redirected to an attacker-controlled host (for example, by supplying a URL to a webhook dispatcher, image proxy, or microservice URL fetcher) can capture bearer tokens, basic-auth credentials, session cookies, and API keys attached to the original request.