CVE-2026-6860: Vert.x Unbounded SNI SslContext Cache Growth Leading to DoS
Summary
CVE-2026-6860: Vert.x has a DoS via unbounded server-side SNI SslContext cache growth. Affects io.vertx:vertx-core across 4 version ranges.
>= 4.3.4, <= 4.3.8
>= 4.4.0, <= 4.4.9
>= 4.5.0, <= 4.5.25
>= 5.0.0, <= 5.0.8
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vert.x is a popular toolkit for building reactive applications on the JVM. It provides a polyglot environment for developing applications using various programming languages. One of its key features is the ability to handle asynchronous network communication, including TLS connections. However, certain versions of Vert.x are vulnerable to a denial-of-service (DoS) attack due to unbounded growth of the server-side SNI SslContext cache, which can lead to resource exhaustion.
Vulnerability Detail
The vulnerability arises from the caching mechanism used in Vert.x for server-side SNI (Server Name Indication) names. When a client connects to a Vert.x server with SNI enabled, the server caches the corresponding SslContext for each unique SNI name. This cache grows unbounded as clients can send numerous distinct SNI names, leading to increased memory consumption over time. The affected versions include 4.3.4 through 4.3.8, 4.4.0 through 4.4.9, 4.5.0 through 4.5.25, and 5.0.0 through 5.0.8. The lack of a bound, TTL, or eviction policy for this cache can result in a DoS condition, where the server becomes unresponsive due to excessive memory usage.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating is not immediately feasible, consider disabling server-side SNI by setting setSni(false) in your Vert.x server configuration. Additionally, avoid using wildcard or high-cardinality hostname mappings to limit the number of unique SNI names that can be cached.
Conclusion
The CVE-2026-6860 vulnerability in Vert.x poses a significant risk due to unbounded growth of the SNI SslContext cache, which can lead to DoS conditions. It is crucial to update to a patched version or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for io.vertx:vertx-core →
FAQ
SNI (Server Name Indication) is an extension to the TLS protocol that allows a client to specify the hostname it is trying to connect to at the start of the handshake process. This enables a server to present the appropriate SSL certificate for that hostname.
If your application uses an affected version of Vert.x with SNI enabled, it may be susceptible to a DoS attack, where an attacker can exhaust server resources by sending numerous unique SNI names, leading to degraded performance or unavailability.
No, only specific versions are affected: 4.3.4 to 4.3.8, 4.4.0 to 4.4.9, 4.5.0 to 4.5.25, and 5.0.0 to 5.0.8. Versions prior to 4.3.4 and those after the patched versions are not affected.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.vertx:vertx-core.
