CVE-2026-15075
Severity CVSS v4.0:
HIGH
Type:
CWE-200
Information Leak / Disclosure
Publication date:
14/07/2026
Last modified:
14/07/2026
Description
In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (scheme, host, port) is performed before copying headers to the redirect target.<br />
As a result, credential headers, including Authorization, Cookie, Proxy-Authorization, and arbitrary custom headers such as X-API-Token, are forwarded to the redirect destination without the caller&#39;s knowledge.<br />
<br />
<br />
<br />
<br />
An attacker who can cause a Vert.x HttpClient to issue a request that is redirected to an attacker-controlled host (for example, by supplying a URL to a webhook dispatcher, image proxy, or microservice URL fetcher) can capture bearer tokens, basic-auth credentials, session cookies, and API keys attached to the original request.
Impact
Base Score 4.0
8.20
Severity 4.0
HIGH
Base Score 3.x
7.50
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* | 4.5.29 (including) | |
| cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* | 5.0.0 (including) | 5.1.4 (including) |
To consult the complete list of CPE names with products and versions, see this page