점검 대응높음KEV 미등록
CVE-2026-15076
Eclipse Foundation Eclipse Vert.x, vert.x 취약점
In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacker who controls any server that the victim application contacts can inject a cookie scoped to an arbitrary third-party domain; because the session store performs no cross-domain ownership check, it stores and later transmits that cookie to the targeted domain. When the victim application subseque...
- 대응 우선순위
- 점검
- CVSS
- 8.2
- EPSS
- 0.16% 백분위 5.34% · 2026.08.03 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.07.14