The vulnerability arises when the Eclipse Vert.x mail client does not sanitize CR (\r) or LF (\n) characters in any header name, header value, or attachment metadata before sending them in the SMTP DATA section. This omission permits an attacker, who can submit arbitrary header information (for example through a web form or API), to inject additional headers such as Bcc, Reply‑To, or Content‑Type, or to prepend content to the message body. The injected lines are written verbatim to the wire, enabling spoofing of sender/recipient fields, unauthorized email forwarding, or disruption of message structure. The weakness is a classic instance of improper input validation (CWE‑93) that directly compromises the integrity of outgoing e‑mail messages.

Eclipse Vert.x—specifically the vertx‑mail‑client component. Versions affected are 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and the single patch release 5.2.0. No other Eclipse Vert.x modules are listed as vulnerable.

The CVSS score of 6.9 indicates a moderate severity; the EPSS score is not available and the issue is not yet listed in CISA KEV. An attacker can exploit the flaw from any source that can control header fields—typically an unauthenticated user interacting with a public or internal mail‑sending API. Because the injection occurs at the wire level, the attacker need only send crafted header data; no additional conditions or privileged access are required. The overall risk is significant for systems that expose mail services via uncontrolled input, and the lack of a current KEV listing does not diminish the potential impact of in‑band exploitation.