CVE-2026-102471

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.34 Eclipse Vert.x versions 5.0.0 through 5.0.12 Eclipse Vert.x versions 5.1.0 through 5.1.9 Eclipse Vert.x version 5.2.0

Description The vertx-mail-client component fails to sanitize Carriage Return (CR) or Line Feed (LF) characters in user-supplied email header names and values before writing them into the SMTP DATA section. An unauthenticated attacker controlling header names, values, or attachment metadata can inject arbitrary headers such as Bcc, Reply-To, or Content-Type, or prepend content to the message body. This issue occurs when values are passed to MailMessage.addHeader(), MailMessage.setHeaders(), MailAttachment.addHeader(), or MailAttachment.setHeaders(). Additionally, MIME part metadata set via MailAttachment.setContentType(), setDisposition(), setDescription(), and setContentId() are written without validation. A secondary issue in Utils.mustEncode(char) allows a bare LF in a From display-name to bypass Q-encoding, which is a method used to encode non-ASCII characters in email headers.

Recommendations Update Eclipse Vert.x versions 4.0.0 through 4.5.34 to a version newer than 4.5.34. Update Eclipse Vert.x versions 5.0.0 through 5.0.12 to a version newer than 5.0.12. Update Eclipse Vert.x versions 5.1.0 through 5.1.9 to a version newer than 5.1.9. Update Eclipse Vert.x version 5.2.0 to a version newer than 5.2.0.