CVE-2026-6860: eclipse foundation eclipse vert.x

CVSS: 6.9v4.0MediumAnalyzed

AliasesCGA-25j7-2h97-48rmCGA-27g8-vf63-2g45CGA-2879-xgqw-fg75+193 more

Published 06-05-2026Last modified 12-05-2026

Vulnerability summary

CVE-2026-6860 is a medium (CVSS 6.9) vulnerability in eclipse foundation eclipse vert.x. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.5% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

38/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.9/10

010

Medium · v4.0 (CVE.org)

EPSS score

0.31%

0%100%

Low · +0.07 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2github, reference

Advisory lineage

Upstream 0 · Downstream 0 · Related 1

CGA-2Q6F-GHC5-4J7V

Timeline

06-05-2026
PublishedVulnerability first disclosed.
12-05-2026
Last modifiedVulnerability information updated.

Description

A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting *.example.com, any XYZ.example.com where xyz is a valid name can be used.

CVSS metrics

7 scores · 5 sources · 2 versions

v4.06.9v3.15.3

EPSS trend

Probability

0.31%

Chance of exploitation in the next 30 days

Percentile

23%

Versus all other CVEs

30-day change

+0.07 pp

From 0.24% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.31%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

githubUnverified
Vert.X
Maturity: poc
referenceUnverified
Exploit Reference (gitlab.eclipse.org)
Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Chainguard80 products

akhq< 0.28.0-r8
apache-camel-karavan-devmode< 4.14.2-r8
apache-pulsar-4.0< 4.0.10-r0
apache-pulsar-4.1< 4.1.3-r11
apache-pulsar-4.2< 4.2.2-r0

apache-pulsar-fips-4.0< 4.0.11-r0
apache-pulsar-fips-4.1All versions (No fix recorded)
apache-pulsar-fips-4.2< 4.2.1-r2
apicurio-registry< 3.2.4-r0 | < 3.2.4-r1
apicurio-registry-fips< 3.3.0-r4
druid< 37.0.0-r19 | < 37.0.0-r56
hono-adapter-mqtt< 2.7.0-r39
hono-cli< 2.7.0-r39
hono-service-auth< 2.7.0-r39
hono-service-command-router< 2.7.0-r39
hono-service-device-registry-jdbc< 2.7.0-r39
kafka_exporter-strimzi-compat< 1.2.0-r4 | < 1.2.0-r5
kafka-bridge< 1.0.0-r3
kafka-strimzi-compat< 1.2.0-r5
keycloak-26.4All versions (No fix recorded)
keycloak-26.4-iamguarded-compatAll versions (No fix recorded)
keycloak-26.4-operatorAll versions (No fix recorded)
keycloak-26.5All versions (No fix recorded)
keycloak-26.5-iamguarded-compatAll versions (No fix recorded)
keycloak-26.5-operatorAll versions (No fix recorded)
keycloak-26.6< 26.6.1-r5
keycloak-26.6-iamguarded-compat< 26.6.1-r5
keycloak-26.6-operator< 26.6.1-r5
keycloak-fips-26.4All versions (No fix recorded)
keycloak-fips-26.4-iamguarded-fipsAll versions (No fix recorded)
keycloak-fips-26.4-operatorAll versions (No fix recorded)
keycloak-fips-26.5All versions (No fix recorded)
keycloak-fips-26.5-iamguarded-fipsAll versions (No fix recorded)
keycloak-fips-26.5-operatorAll versions (No fix recorded)
keycloak-fips-26.6< 26.6.2-r0
keycloak-fips-26.6-iamguarded-fips< 26.6.2-r0
keycloak-fips-26.6-operator< 26.6.2-r0
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r6
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r6
knative-kafka-broker-1.21-dispatcher-loom< 1.21.4-r5
knative-kafka-broker-1.21-receiver-loom< 1.21.4-r5
knative-kafka-broker-1.22-dispatcher-loom< 1.22.1-r7
knative-kafka-broker-1.22-receiver-loom< 1.22.1-r7
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r6
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r6
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.3-r10
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.3-r10
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.1-r5
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.1-r5
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
request-9047-keycloak-fips-26.4< 26.4.7-r28
request-9047-keycloak-fips-26.4-iamguarded-fips< 26.4.7-r28
request-9047-keycloak-fips-26.4-operator< 26.4.7-r28
request-9047-keycloak-fips-26.5< 26.5.7-r3
request-9047-keycloak-fips-26.5-iamguarded-fips< 26.5.7-r3
request-9047-keycloak-fips-26.5-operator< 26.5.7-r3
spark-4.0-scala-2.13< 4.0.2-r11
spark-4.1-scala-2.13< 4.1.2-r3
spark-fips-4.1-scala-2.13< 4.1.2-r2
spark-kubernetes-operator< 0.8.0-r2
spark-kubernetes-operator-fips< 1.0.0-r0
strimzi-kafka-operatorAll versions (No fix recorded) | < 1.2.0-r5
strimzi-kafka-operator-cluster-operator< 1.2.0-r5 | < 1.1.0-r0 | < 1.2.0-r4
strimzi-kafka-operator-fips-cluster-operator< 1.1.0-r0
strimzi-kafka-operator-fips-kafka-agent< 1.1.0-r0
strimzi-kafka-operator-fips-kafka-init< 1.1.0-r0
strimzi-kafka-operator-fips-kafka-thirdparty-libs-cc< 1.1.0-r2
strimzi-kafka-operator-fips-topic-operator< 1.1.0-r0
strimzi-kafka-operator-fips-tracing-agent< 1.1.0-r0
strimzi-kafka-operator-fips-user-operator< 1.1.0-r0
strimzi-kafka-operator-kafka-agent< 1.2.0-r5 | < 1.1.0-r0
strimzi-kafka-operator-kafka-baseAll versions (No fix recorded) | < 1.2.0-r5
strimzi-kafka-operator-kafka-init< 1.2.0-r5 | < 1.1.0-r0 | < 1.2.0-r4
strimzi-kafka-operator-kafka-thirdparty-libs< 1.2.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 1.1.0-r5 | < 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-topic-operator< 1.1.0-r0 | < 1.2.0-r5 | < 1.2.0-r4
strimzi-kafka-operator-tracing-agent< 1.2.0-r5 | < 1.1.0-r0
strimzi-kafka-operator-user-operator< 1.2.0-r5 | < 1.1.0-r0
wildfly-openjdk-17< 40.0.0-r0
wildfly-openjdk-21< 40.0.0-r0

Show all 80

Wolfi31 products

akhq< 0.28.0-r8
apache-pulsar-4.1< 4.1.3-r11
apache-pulsar-4.2< 4.2.2-r0
apicurio-registry< 3.2.4-r0 | < 3.2.4-r1
druid< 37.0.0-r19 | < 37.0.0-r56

Show all 31

Eclipse1 product

vert.x≥ 4.3.4, ≤ 4.5.26 | ≥ 5.0.0, ≤ 5.0.11

Eclipse foundation1 product

eclipse vert.x≥ 4.3.4, ≤ 4.5.26 | ≥ 5.0.0, ≤ 5.0.11

Io.vertx1 product

vertx-core≥ 4.3.4, ≤ 4.3.8 | ≥ 4.4.0, ≤ 4.4.9 | ≥ 4.5.0, < 4.5.27 | ≥ 5.0.0, < 5.0.12

5 vendors · 114 products

References

9 links

gitlab.eclipse.org/security/vulnerability-reports/-/issues/381REPORTWEBExploitIssue TrackingThird Party Advisory
github.com/eclipse-vertx/vert.x/security/advisories/GHSA-3g76-f9xq-8vp6AdvisoryWEBExploitVendor Advisory
github.com/eclipse-vertx/vert.x/pull/6102FIXWEBIssue TrackingPatch
github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6860.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-6860Advisory
github.com/eclipse-vertx/vert.xPACKAGE
github.com/vert-x3/wiki/wiki/4.5.27-Release-NotesWEB
vertx.io/blog/eclipse-vert-x-4-5-27WEB
vertx.io/blog/eclipse-vert-x-5-0-12WEB

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities