# io.vertx:vertx-core (Maven) vulnerabilities

7 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/io.vertx/vertx-core

## Advisories (7)

### [CVE-2026-6860](https://cve.now/CVE-2026-6860): A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard…

- Severity: Medium 6.9
- Published: May 6, 2026
- Affected: from 4.3.4, through 4.3.8; from 4.4.0, through 4.4.9; from 4.5.0, fixed in 4.5.27; from 5.0.0, fixed in 5.0.12.

### [CVE-2026-1002](https://cve.now/CVE-2026-1002): Eclipse Vert.x Web static handler file access denial

- Severity: Medium 6.9
- Published: Jan 15, 2026
- Affected: fixed in 4.5.24; from 5.0.0.CR1, fixed in 5.0.7.

### [CVE-2024-1300](https://cve.now/CVE-2024-1300): Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support

- Severity: Medium 5.4
- Published: Apr 2, 2024
- Affected: from 4.3.4, fixed in 4.4.8; from 4.5.0, fixed in 4.5.3.

### [CVE-2024-1023](https://cve.now/CVE-2024-1023): Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx

- Severity: Medium 6.5
- Published: Mar 27, 2024
- Affected: from 4.5.0, fixed in 4.5.2; from 4.4.5, fixed in 4.4.7.

### [CVE-2018-12544](https://cve.now/CVE-2018-12544): In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate…

- Severity: Unrated
- Published: Oct 10, 2018
- Affected: from 3.5.0, fixed in 3.5.4.

### [CVE-2018-12541](https://cve.now/CVE-2018-12541): In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the…

- Severity: Unrated
- Published: Oct 10, 2018
- Affected: from 3.0.0, fixed in 3.5.4.

### [CVE-2018-12537](https://cve.now/CVE-2018-12537): In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and…

- Severity: Unrated
- Published: Aug 14, 2018
- Affected: from 3.0.0, fixed in 3.5.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/io.vertx:vertx-core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.