EUVD-2026-43637
GHSA-vjx2-fp9g-q2mc
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Cross-domain cookie injection in Eclipse Vert.x Web Client (WebClientSession) lets any server a victim application contacts set a cookie scoped to an unrelated third-party domain, which the client later replays to that domain. Versions up to 4.5.29 (4.x) and 5.1.4 (5.x) fail to enforce the RFC 6265 Domain-attribute ownership check, so an attacker can bind their own session cookie into the victim's WebClientSession and have the victim's later requests to a target service execute under the attacker's account, exposing sensitive request payloads. No public exploit identified at time of analysis and it is not listed in CISA KEV; scored CVSS 4.0 8.2 (High) by Eclipse.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Eclipse Vert X gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
DescriptionCVE.org
In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacker who controls any server that the victim application contacts can inject a cookie scoped to an arbitrary third-party domain; because the session store performs no cross-domain ownership check, it stores and later transmits that cookie to the targeted domain.
When the victim application subsequently sends a request to the targeted domain using the same WebClientSession, it presents the attacker-injected cookie, causing the receiving service to process the request under the attacker's account. Sensitive data included in the victim application's requests, such as payment amounts, card details, or other API payloads, may then be accessible to the attacker through their own account on that service.
Executive ViewAI
Eclipse Vert.x Web Client versions 4.5.29 and earlier (4.x line) and 5.1.4 and earlier (5.x line) are vulnerable to cross-domain cookie injection that allows attackers to inject malicious session cookies through any server the application contacts. Applications using affected versions risk exposing sensitive request payloads to attackers or experiencing session hijacking on downstream services, particularly when communicating with external APIs or third-party integrations.
Within 24 hours, inventory all applications using Eclipse Vert.x Web Client and identify those with versions 4.5.29 or earlier (4.x) or 5.1.4 or earlier (5.x), prioritizing those that communicate with external services or handle sensitive data. Within 7 days, implement strict domain whitelisting in Vert.x client configuration to limit which external services the client contacts, deploy network-layer controls to restrict egress to trusted domains only, and add application-level cookie validation to reject cookies with mismatched domain attributes. Within 30 days, upgrade to patched versions of Eclipse Vert.x Web Client once released (monitor Eclipse security advisories for availability), or migrate to an alternative HTTP client library with verified RFC 6265 compliance if upgrades remain unavailable beyond 30 days.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) enforce strict domain whitelisting in Vert.x client configuration; (2) deploy egress filtering at the network perimeter; (3) implement application-layer cookie validation to reject domain-attribute violations; (4) enable detailed logging and alerting on cross-domain cookie usage patterns; (5) place a reverse proxy or API gateway with cookie filtering rules in front of vulnerable Vert.x clients until patches become available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Eclipse Vert X
View allEclipse Vert.x DB2 Client versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 can deseri
Denial of service in Eclipse Vert.x JSON Schema validation (io.vertx:vertx-json-schema) allows a remote unauthenticated
Unauthenticated remote attackers can exhaust server memory in Eclipse Vert.x deployments that expose the io.vertx:vertx-
Denial of service in Eclipse Vert.x HTTP proxy (io.vertx:vertx-http-proxy) affects versions 5.0.0 through 5.0.12, 5.1.0
Denial-of-service in Eclipse Vert.x allows unauthenticated remote attackers to exhaust server memory by sending compress
Unbounded direct-memory allocation in Eclipse Vert.x's MySQL client (io.vertx:vertx-mysql-client) versions 4.0.0 through
An unbounded-memory denial of service in the Eclipse Vert.x PostgreSQL client (io.vertx:vertx-pg-client) allows a malici
Unbounded direct-memory allocation in Eclipse Vert.x's MSSQL client (io.vertx:vertx-mssql-client) lets a malicious, comp
Unbounded inbound memory retention in the Eclipse Vert.x MQTT client (io.vertx:vertx-mqtt) allows a malicious or comprom
Denial of service in Eclipse Vert.x's vertx-pg-client component allows an attacker controlling the PostgreSQL server or
Denial of service in the Vert.x MySQL client (io.vertx:vertx-mysql-client) lets an attacker who controls or intercepts t
Denial of service in the Eclipse Vert.x Redis client (io.vertx:vertx-redis-client) affects versions 4.0.0 through 4.5.34
Exploit-DB