CVE-2026-102471

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value passed to MailMessage.addHeader(), MailMessage.setHeaders(), MailAttachment.addHeader(), or MailAttachment.setHeaders() is written verbatim to the wire, allowing an attacker to inject arbitrary headers (e.g. Bcc, Reply-To, Content-Type) or prepend body content to the outgoing message. The same weakness affects MIME part metadata set via MailAttachment.setContentType(), setDisposition(), setDescription(), and setContentId(), which are written directly into MIME part headers without validation. A secondary weakness in Utils.mustEncode(char) additionally allows a bare LF in a From display-name to bypass Q-encoding and reach the wire unchanged. An unauthenticated attacker who can control any header name, header value, or attachment metadata field passed to the mail client (for example via a web form or API that feeds into MailMessage) can exploit this to redirect email copies, spoof headers, or tamper with message structure. The impacted component is io.vertx:vertx-mail-client.

• CWE-93

• https://github.com/vert-x3/vertx-mail-client/security/advisories/GHSA-rm5c-2c7f-gc5gVendor Advisory
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/348Issue Tracking, Third Party Advisory

Published

Oct 14, 2026

Last Modified

Oct 20, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102464In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]…5.9
• CVE-2026-102465In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]…5.9
• CVE-2026-102466In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]…5.9
• CVE-2026-102467In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]…5.9
• CVE-2026-102469In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]…5.9
• CVE-2026-10247A vulnerability was found in SourceCodester Pharmacy Sales a…3.5
• CVE-2026-102473A flaw was found in dash. When built without libc fnmatch, t…5.5
• CVE-2026-102474A flaw was found in dash. The printf builtin reserves four b…4
• CVE-2026-102475In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] o…5.9
• CVE-2026-102476In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] o…9.1
• CVE-2026-102477In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12]…5.9
• CVE-2026-102478In affected versions of Octopus Server, an authenticated use…8.7