Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (scheme, host, port) is performed before copying headers to the redirect target. As a result, credential headers, including Authorization, Cookie, Proxy-Authorization, and arbitrary custom headers such as X-API-Token, are forwarded to the redirect destination without the caller's knowledge. An attacker who can cause a Vert.x HttpClient to issue a request that is redirected to an attacker-controlled host (for example, by supplying a URL to a webhook dispatcher, image proxy, or microservice URL fetcher) can capture bearer tokens, basic-auth credentials, session cookies, and API keys attached to the original request.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-14 | 2 | Disclosure2 |
| 2026-07-15 | 3 | Disclosure2Patch1 |
| 2026-07-20 | 1 | Patch1 |
Your Vert.x HttpClient is leaking credentials to redirect targets. CVE-2026-15075 (CVSS 7.5) shipped Authorization and Cookie headers across 30x redirects with zero origin checks. Here's what breaks:
Post summary
Vulnerability CVE-2026-15075 leaks credentials across redirects; no PoC, exploits, or remediation details provided.
⚠️ Linux Cryostat 4 alert: CVE-2026-15075 (CVSS 7.5) Attackers could access sensitive information. Apply the vendor-recommended mitigation. https://vulnipulse.com/advisories/linux-cve-2026-15075 #Linux #Cryostat4 #CyberSecurity #CVE
Post summary
The advisory announces CVE‑2026‑15075, warns attackers can access sensitive data, and advises applying the vendor‑recommended mitigation.
🔵 Eclipse Vertx DefaultRedirectHandler Cross-Origin Header Propagation Vulnerability (#CVE-2026-15075) [bash] -DC-Jul2026-997 https://dailycve.com/eclipse-vertx-defaultredirecthandler-cross-origin-header-propagation-vulnerability-cve-2026-15075-bash-dc-jul2026-997/
Post summary
The text announces a newly disclosed CVE for Eclipse Vertx but provides no additional details on exploitation, patches, or technical aspects.
This is why I whitelist redirect destinations or disable followRedirects entirely for external URLs. Your webhook logger shouldn't need to chase 302s anyway. https://nvd.nist.gov/vuln/detail/CVE-2026-15075
Post summary
The tweet references CVE‑2026‑15075, offering a workaround by whitelisting redirects or disabling followRedirects, but it provides no exploit details or evidence of active exploitation.
🚨*CVE* CVE-2026-15075 In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is ac… https://www.cve.org/CVERecord?id=CVE-2026-15075 ----- Traducción: CVE-2026-15075 En … http://infoflow.cloud`
Post summary
A new CVE-2026-15075 affecting Eclipse Vert.x’s DefaultRedirectHandler is disclosed, with a brief technical description but no PoC, exploit, or patch details.
CVE-2026-15075 In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is ac… https://www.cve.org/CVERecord?id=CVE-2026-15075
Post summary
The entry announces CVE-2026-15075, describing a header propagation flaw in Vert.x’s DefaultRedirectHandler affecting versions 4.5.29 and 5.1.4, but does not provide PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | eclipse | vert.x | - | - | - |