CVE-2026-6860
Full vulnerability record from the local CVENow database.
Description
A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting *.example.com, any XYZ.example.com where xyz is a valid name can be used.
Severity
MEDIUM
CVSS score
6.9
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-06 10:16:26.293000
Last modified
2026-10-26 19:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-6860",
"sourceIdentifier": "[email protected]",
"published": "2026-05-06T10:16:26.293",
"lastModified": "2026-10-26T19:10:00.163",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting *.example.com, any XYZ.example.com where xyz is a valid name can be used."
},
{
"lang": "es",
"value": "Un cliente TCP puede realizar un handshake TLS y presentar la extensión de nombre de servidor con un nombre de servidor que es aceptado por un nombre de servidor comodín, p. ej. si el servidor está configurado con un certificado que acepta *.example.com, se puede usar cualquier XYZ.example.com donde xyz sea un nombre válido."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Eclipse Foundation",
"product": "Eclipse Vert.x",
"defaultStatus": "unaffected",
"versions": [
{
"version": "4.3.4",
"lessThanOrEqual": "4.5.26",
"versionType": "semver",
"status": "affected"
},
{
"version": "5.0.0",
"lessThanOrEqual": "5.0.11",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "LOW",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-06T14:33:37.747093Z",
"id": "CVE-2026-6860",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-295"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.3.4",
"versionEndIncluding": "4.5.26",
"matchCriteriaId": "2D97737D-C9E5-44D5-B960-CDB913B633A2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.0.0",
"versionEndIncluding": "5.0.11",
"matchCriteriaId": "FA536485-C257-482E-95AB-D22B0C596F68"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/eclipse-vertx/vert.x/pull/6102",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Patch"
]
},
{
"url": "https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-3g76-f9xq-8vp6",
"source": "[email protected]",
"tags": [
"Exploit",
"Vendor Advisory"
]
},
{
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/381",
"source": "[email protected]",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
]
},
{
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/381",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
]
}
]
}