Medium severity5.3NVD Advisory· Published May 6, 2026· Updated May 12, 2026

CVE-2026-6860

Description

A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting *.example.com, any XYZ.example.com where xyz is a valid name can be used.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
io.vertx:vertx-coreMaven	>= 4.3.4, <= 4.3.8	—
io.vertx:vertx-coreMaven	>= 4.4.0, <= 4.4.9	—
io.vertx:vertx-coreMaven	>= 4.5.0, < 4.5.27	4.5.27
io.vertx:vertx-coreMaven	>= 5.0.0, < 5.0.12	5.0.12

Affected products

Eclipse/Vert.xreferences2 versions
(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*range: >=4.3.4,<=4.5.26
osv-coords46 versions
pkg:apk/chainguard/apache-camel-karavan-devmode pkg:apk/chainguard/apache-pulsar-4.0 pkg:apk/chainguard/apache-pulsar-4.1 pkg:apk/chainguard/apache-pulsar-4.2 pkg:apk/chainguard/apache-pulsar-fips-4.0 pkg:apk/chainguard/apache-pulsar-fips-4.2 pkg:apk/chainguard/apicurio-registry pkg:apk/chainguard/kafka-bridge pkg:apk/chainguard/keycloak-26.6 pkg:apk/chainguard/keycloak-26.6-iamguarded-compat pkg:apk/chainguard/keycloak-26.6-operator pkg:apk/chainguard/keycloak-fips-26.6 pkg:apk/chainguard/keycloak-fips-26.6-iamguarded-fips pkg:apk/chainguard/keycloak-fips-26.6-operator pkg:apk/chainguard/knative-kafka-broker-1.20-dispatcher-loom pkg:apk/chainguard/knative-kafka-broker-1.20-receiver-loom pkg:apk/chainguard/knative-kafka-broker-1.21-dispatcher-loom pkg:apk/chainguard/knative-kafka-broker-1.21-receiver-loom pkg:apk/chainguard/knative-kafka-broker-1.22-dispatcher-loom pkg:apk/chainguard/knative-kafka-broker-1.22-receiver-loom pkg:apk/chainguard/knative-kafka-broker-fips-1.20-dispatcher-loom pkg:apk/chainguard/knative-kafka-broker-fips-1.20-receiver-loom pkg:apk/chainguard/knative-kafka-broker-fips-1.21-dispatcher-loom pkg:apk/chainguard/knative-kafka-broker-fips-1.21-receiver-loom pkg:apk/chainguard/knative-kafka-broker-fips-1.22-dispatcher-loom pkg:apk/chainguard/knative-kafka-broker-fips-1.22-receiver-loom pkg:apk/chainguard/request-9047-keycloak-fips-26.5 pkg:apk/chainguard/request-9047-keycloak-fips-26.5-iamguarded-fips pkg:apk/chainguard/request-9047-keycloak-fips-26.5-operator pkg:apk/chainguard/spark-4.0-scala-2.13 pkg:apk/chainguard/spark-4.1-scala-2.13 pkg:apk/chainguard/spark-fips-4.1-scala-2.13 pkg:apk/chainguard/spark-kubernetes-operator pkg:apk/chainguard/wildfly-openjdk-17 pkg:apk/chainguard/wildfly-openjdk-21 pkg:apk/wolfi/apache-pulsar-4.1 pkg:apk/wolfi/apache-pulsar-4.2 pkg:apk/wolfi/apicurio-registry pkg:apk/wolfi/keycloak-26.6 pkg:apk/wolfi/keycloak-26.6-iamguarded-compat pkg:apk/wolfi/keycloak-26.6-operator pkg:apk/wolfi/spark-4.0-scala-2.13 pkg:apk/wolfi/spark-4.1-scala-2.13 pkg:apk/wolfi/wildfly-openjdk-17 pkg:apk/wolfi/wildfly-openjdk-21 pkg:maven/io.vertx/vertx-core
< 4.14.2-r8+ 45 more
- (no CPE)range: < 4.14.2-r8
- (no CPE)range: < 4.0.10-r0
- (no CPE)range: < 4.1.3-r11
- (no CPE)range: < 4.2.2-r0
- (no CPE)range: < 4.0.11-r0
- (no CPE)range: < 4.2.1-r2
- (no CPE)range: < 3.2.4-r1
- (no CPE)range: < 1.0.0-r3
- (no CPE)range: < 26.6.1-r5
- (no CPE)range: < 26.6.1-r5
- (no CPE)range: < 26.6.1-r5
- (no CPE)range: < 26.6.2-r0
- (no CPE)range: < 26.6.2-r0
- (no CPE)range: < 26.6.2-r0
- (no CPE)range: < 1.20.3-r6
- (no CPE)range: < 1.20.3-r6
- (no CPE)range: < 1.21.4-r5
- (no CPE)range: < 1.21.4-r5
- (no CPE)range: < 1.22.1-r7
- (no CPE)range: < 1.22.1-r7
- (no CPE)range: < 1.20.3-r6
- (no CPE)range: < 1.20.3-r6
- (no CPE)range: < 1.21.3-r10
- (no CPE)range: < 1.21.3-r10
- (no CPE)range: < 1.22.1-r5
- (no CPE)range: < 1.22.1-r5
- (no CPE)range: < 26.5.7-r3
- (no CPE)range: < 26.5.7-r3
- (no CPE)range: < 26.5.7-r3
- (no CPE)range: < 4.0.2-r11
- (no CPE)range: < 4.1.2-r3
- (no CPE)range: < 4.1.1-r13
- (no CPE)range: < 0.8.0-r2
- (no CPE)range: < 40.0.0-r0
- (no CPE)range: < 40.0.0-r0
- (no CPE)range: < 4.1.3-r11
- (no CPE)range: < 4.2.2-r0
- (no CPE)range: < 3.2.4-r1
- (no CPE)range: < 26.6.1-r5
- (no CPE)range: < 26.6.1-r5
- (no CPE)range: < 26.6.1-r5
- (no CPE)range: < 4.0.2-r11
- (no CPE)range: < 4.1.2-r3
- (no CPE)range: < 40.0.0-r0
- (no CPE)range: < 40.0.0-r0
- (no CPE)range: >= 4.3.4, <= 4.3.8

Patches

Vulnerability mechanics

References

github.com/eclipse-vertx/vert.x/pull/6102nvdIssue TrackingPatchWEB
gitlab.eclipse.org/security/vulnerability-reports/-/issues/381nvdExploitIssue TrackingThird Party AdvisoryWEB
github.com/advisories/GHSA-3g76-f9xq-8vp6ghsaADVISORY
github.com/eclipse-vertx/vert.x/security/advisories/GHSA-3g76-f9xq-8vp6nvdVendor AdvisoryExploitWEB
nvd.nist.gov/vuln/detail/CVE-2026-6860ghsaADVISORY
vertx.io/blog/eclipse-vert-x-4-5-27ghsaWEB
vertx.io/blog/eclipse-vert-x-5-0-12ghsaWEB

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

5.3/ 10

CVSS v46.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected

Source repos: github.com/eclipse-vertx/vert.x
github.com/vert-x3/wiki/wiki/4.5.27-Release-Notes

EPSS

Probability of exploitation in the next 30 days.

0.24%

VYPR risk score

Composite of severity, exploitation, and reach.

0.27low

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

Weaknesses

CWE-295
Improper Certificate Validation
CWE-770
Allocation of Resources Without Limits or Throttling

CVE ID

CVE-2026-6860

Credits

S
shblue21
finder · ghsa
J
julianladisch
analyst · ghsa
P
Preethi-30
analyst · ghsa