The Vert.x HTTP client stores SSL contexts in a cache keyed only on a subset of SSL properties. When a client requests a secure context, the cache may return an entry that ignores hostname validation, allowing an attacker to establish an encrypted connection to a malicious server that presents a certificate that does not match the expected hostname. This flaw enables the browser‑like client to accept certificates from spoofed or compromised servers, directly compromising confidentiality and integrity of data transmitted over TLS and creating a pathway for passive or active man‑in‑the‑middle attacks.

Eclipse Vert.x releases 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and the single 5.2.0 build are impacted, specifically the io.vertx:vertx-core component used by applications that rely on the Vert.x HTTP client for outbound TLS communication.

The high CVSS score of 9.1 indicates a severe threat if exploited. However, the EPSS score of less than 1% suggests that, as of now, the likelihood of widespread exploitation is low. The vulnerability is not listed in the CISA KEV catalog, but that does not diminish the potential harm. The most probable attack vector involves an adversary manipulating the target host name in a client connection request to trigger the creation or retrieval of a weak SSL context from the cache. If an attacker can direct the client to a malicious server during such a request, hostname validation will be bypassed and the client will accept a certificate from an untrusted source, enabling interception and tampering of otherwise encrypted traffic.