The Vert.x HTTP/1.x decoder incorrectly canonicalizes certain HTTP header names. A crafted header such as Content-Xength is treated as the standard Content-Length header. This flaw enables an attacker to craft requests that the server accepts as well‑formed while containing hidden manipulation, allowing request smuggling attacks that can alter or bypass downstream services, potentially leaking data or executing unintended commands.

Vendors affected are Eclipse Vert.x, specifically versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and the standalone 5.2.0 release. The component impacted is io.vertx:vertx-core. Any application deploying these Vert.x versions is at risk unless mitigated.

The score of 8.7 on the CVSS base metrics places this as a high‑severity vulnerability. The EPSS score indicates a very low exploitation probability (<1%), and it is not currently listed in the CISA KEV catalog, suggesting no mass exploitation reported yet. While the attack requires HTTP header manipulation, it can typically be performed from any remote client, making it a remote, network‑level threat. The canonicalization flaw directly supports request smuggling, a powerful technique that can bypass security controls and compromise downstream services.