6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-6860

CVE-2026-6860: Vert.x has a DoS via unbounded server-side SNI SslContext cache growth

Potential unbounded server-side SNI SslContext cache growth in Vert.x TLS handling, with = resource-exhaustion / DoS impact. On affected versions, matching server-side SNI names are cached via computeIfAbsent(serverName, ...) in a serverName-keyed SslContext cache.

The implementation differs slightly by branch, but the same sink appears to be present in released versions 4.3.4 through 5.0.11:

4.3.x: SSLHelper
4.4.x / 4.5.x: SslChannelProvider
5.0.x and current master: SslContextProvider

When server-side SNI is enabled and wildcard or otherwise broad hostname mappings are used, an unauthenticated client can send many distinct matching SNI names and cause the server to retain increasing numbers of SslContext entries over time, leading to increasing memory consumption and possible DoS conditions.

Steps to reproduce

Configure a Vert.x server with setSsl(true) and setSni(true).
Use a keystore or mapping where many distinct SNI names match a wildcard or similarly broad rule.
Send repeated connections with distinct matching SNI values.
Observe that the SNI cache size grows with the number of unique matching names.

What are the affected versions?

Affected released versions confirmed on origin:

4.3.4 through 4.3.8
4.4.0 through 4.4.9
4.5.0 through 4.5.26
5.0.0 through 5.0.11

Not affected by the same sink:

4.0.x through 4.2.x
4.3.0 through 4.3.3

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-6860

CVE-2026-6860:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.vertx:vertx-core	maven	>= 4.3.4, <= 4.3.8
io.vertx:vertx-core	maven	>= 4.4.0, <= 4.4.9
io.vertx:vertx-core	maven	>= 4.5.0, <= 4.5.26	4.5.27
io.vertx:vertx-core	maven	>= 5.0.0, <= 5.0.11	5.0.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service caused by an unbounded cache for server-side SNI SslContext objects in Vert.x. When a client connects using TLS with SNI, the server caches the SslContext corresponding to the provided SNI hostname. The vulnerability description and the provided patch (commit cde2517fca4cd9f77e1ad51e0c92fb02a249cc87) confirm that this cache was implemented using an unbounded ConcurrentHashMap.

The analysis of the patch for the master branch of eclipse-vertx/vert.x pinpoints the vulnerable function as io.vertx.core.internal.tls.SslContextProvider.sslContext. This function uses computeIfAbsent on the sslContextMaps map, using the client-controlled serverName as the key. An attacker can repeatedly connect with new, unique SNI names, causing the map to grow without bounds, leading to excessive memory consumption and a DoS.

The fix applied in the patch is to replace the ConcurrentHashMap with a custom, size-limited LruCache, thus bounding the growth of the cache and preventing the DoS attack. While the vulnerability description mentions that other classes (SSLHelper, SslChannelProvider) are affected in older versions, the provided patch only modifies SslContextProvider, which is the affected class in recent versions.

Vulnerable functions

io.vertx.core.internal.tls.SslContextProvider.sslContext

vertx-core/src/main/java/io/vertx/core/internal/tls/SslContextProvider.java

This function is responsible for caching `SslContext` instances based on the SNI `serverName` provided by the client during the TLS handshake. The vulnerability lies in the use of an unbounded `ConcurrentHashMap` (`sslContextMaps`) for this cache. An attacker could send a large number of unique SNI hostnames, causing the cache to grow indefinitely. Each new entry consumes memory, eventually leading to a denial-of-service through memory exhaustion. The patch replaces the `ConcurrentHashMap` with a bounded `LruCache` to mitigate this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.