CVE-2026-15076

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-15076
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15076.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-15076
Published
2026-07-14T08:09:12.951Z
Modified
2026-07-16T03:47:32.091305077Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
[none]
Details

In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacker who controls any server that the victim application contacts can inject a cookie scoped to an arbitrary third-party domain; because the session store performs no cross-domain ownership check, it stores and later transmits that cookie to the targeted domain.

When the victim application subsequently sends a request to the targeted domain using the same WebClientSession, it presents the attacker-injected cookie, causing the receiving service to process the request under the attacker's account. Sensitive data included in the victim application's requests, such as payment amounts, card details, or other API payloads, may then be accessible to the attacker through their own account on that service.

Database specific 
{
    "cwe_ids": [
        "CWE-346"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15076.json",
    "cna_assigner": "eclipse"
}
References

Affected packages

Git / github.com/eclipse-vertx/vert.x

Affected ranges

Type
GIT
Repo
https://github.com/eclipse-vertx/vert.x
Events
Introduced
60a85baf9138c1cf7e816587d9f59a70ed55bcf3
Last affected
b7545753dacac2add45c443574a5d1de13e2e805
Introduced
6feb3f329729d6c78f6544b542b1668a3e9f6704
Last affected
753360696b3cbb3b6848a03f07a84f07f045da96
Database specific 
{
    "cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.5.29"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "last_affected": "5.1.4"
        }
    ],
    "source": "CPE_RANGE"
}
Type
GIT
Repo
https://github.com/vert-x3/vertx-web
Events
Introduced
7553ecb4e6bbe2888dd20e81675f662df26645b5
Last affected
0dc2b837dfb99d8a179fafb1b348a4843ab00e3d
Introduced
a62720242d2f515969aa34dd185d870b846be5e1
Last affected
c248720fd671d3d33a57ce72c37603989ccd2efc
Database specific 
{
    "cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.5.29"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "last_affected": "5.1.4"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.1.0
4.1.0.Beta1
4.1.0.CR1
4.1.0.CR2
4.1.1
4.2.0
4.2.0.Beta1
4.2.0.CR1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.5.0
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.15
4.5.16
4.5.17
4.5.18
4.5.19
4.5.2
4.5.20
4.5.21
4.5.22
4.5.23
4.5.24
4.5.25
4.5.26
4.5.27
4.5.28
4.5.29
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
5.*
5.0.0
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15076.json"