CVE-2018-12537: Eclipse Vert.x

Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days.

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.

Affected products

• Eclipse Vert.x: from 3.0.0, up to and including 3.5.1

Published 2018-08-14. Last modified 2026-06-17.