CVE-2026-6860 Details
Description
A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting *.example.com, any XYZ.example.com where xyz is a valid name can be used.
A denial-of-service vulnerability has been identified in Eclipse Vert.x versions 4.3.4 through 5.0.8. The issue arises from unbounded growth in the server-side SNI (Server Name Indication) cache during TLS handshakes. When a TCP client presents SNI names that match a wildcard certificate (e.g., *.example.com), the server caches these entries without a limit or eviction policy. This can lead to increased memory consumption and potential resource exhaustion.
Users can disable server-side SNI if it is not needed, avoid wildcard hostname mappings that could lead to high cache growth, and apply rate limiting or connection controls in front of the service.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/381 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://github.com/eclipse-vertx/vert.x/pull/6102 | [email protected] | Issue TrackingPatch |
| https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-3g76-f9xq-8vp6 | [email protected] | ExploitVendor Advisory |
| https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/381 | [email protected] | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
| CWE-295 | Improper Certificate Validation | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| eclipse vert.x | >= 4.3.4, <= 4.5.26 >= 5.0.0, <= 5.0.11 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | Initial Analysis | [email protected] |
| May 12, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | New CVE Received | [email protected] |