io.vertx:vertx-core 4.0.0-milestone2

Direct Vulnerabilities

Known vulnerabilities in the io.vertx:vertx-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Origin Validation Error io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM. Affected versions of this package are vulnerable to Origin Validation Error in the `DefaultRedirectHandler`, which forwards request headers, including `Authorization`, `Cookie`, `Proxy-Authorization`, and custom headers such as `X-API-Token`, across cross-origin redirects without comparing the scheme, host, and port of the origin. An attacker controlling a redirect destination can capture bearer tokens, basic-auth credentials, session cookies, and API keys attached to the original request by returning a redirect to a host they control. This requires the attacker to cause a Vert.x `HttpClient` request to be redirected to that host, such as through a webhook dispatcher or image proxy that follows redirects. How to fix Origin Validation Error? Upgrade `io.vertx:vertx-core` to version 4.5.30, 5.1.5 or higher.	[4.0.0.Beta1,4.5.30)[5.0.0.CR1,5.1.5)
M HTTP Request Smuggling io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM. Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper handling of `/` in the output buffer by `removeDots()` function in Static Handler. An attacker can prevent access to static files by sending specifically crafted request URIs that exploit improper handling of encoded path traversal sequences. How to fix HTTP Request Smuggling? Upgrade `io.vertx:vertx-core` to version 4.5.24 or higher.	[,4.5.24)

Vulnerability

Vulnerable Version

Origin Validation Error

io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM.

Affected versions of this package are vulnerable to Origin Validation Error in the DefaultRedirectHandler, which forwards request headers, including Authorization, Cookie, Proxy-Authorization, and custom headers such as X-API-Token, across cross-origin redirects without comparing the scheme, host, and port of the origin. An attacker controlling a redirect destination can capture bearer tokens, basic-auth credentials, session cookies, and API keys attached to the original request by returning a redirect to a host they control. This requires the attacker to cause a Vert.x HttpClient request to be redirected to that host, such as through a webhook dispatcher or image proxy that follows redirects.

How to fix Origin Validation Error?

Upgrade io.vertx:vertx-core to version 4.5.30, 5.1.5 or higher.

[4.0.0.Beta1,4.5.30)[5.0.0.CR1,5.1.5)

HTTP Request Smuggling

io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM.

Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper handling of / in the output buffer by removeDots() function in Static Handler. An attacker can prevent access to static files by sending specifically crafted request URIs that exploit improper handling of encoded path traversal sequences.

How to fix HTTP Request Smuggling?

Upgrade io.vertx:vertx-core to version 4.5.24 or higher.

[,4.5.24)

io.vertx:vertx-core@4.0.0-milestone2

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically