Eclipse Vert.x CVE-2026-6860

The vulnerability exists in Eclipse Vert.x's TLS/SSL implementation, specifically in the SslContextProvider and SslContextManager classes that handle Server Name Indication (SNI) hostname resolution during TLS handshakes. The root cause is improper cache management in the SNI lookup mechanism: the original implementation used unbounded ConcurrentHashMap structures to cache SSL contexts keyed by server name. When a client presents a TLS SNI extension with a hostname matching a wildcard certificate pattern (e.g., *.example.com), the server accepts any XYZ.example.com variant without proper validation that the requested hostname is actually authorized for that certificate. This allows an attacker to request SSL contexts for arbitrary subdomain names that match the wildcard pattern, causing the server to return valid SSL contexts intended for different purposes. The fix introduces an LruCache (Least Recently Used cache) with bounded size (DEFAULT_SNI_CACHE_SIZE=16) to limit memory exposure and proper synchronization to prevent race conditions in multi-threaded scenarios. The underlying protocol involved is TLS 1.2/1.3 with SNI (RFC 6066), which allows clients to specify the intended server hostname during the handshake to support virtual hosting over TLS.