CVE-2026-15075

A flaw was found in Eclipse Vert.x. The DefaultRedirectHandler in vertx-core improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a Vert.x HttpClient request to a malicious host. This allows the attacker to capture sensitive information such as bearer tokens, basic authentication credentials, session cookies, and API keys, leading to unauthorized access or further attacks.

This is an Important information disclosure flaw in Eclipse Vert.x's DefaultRedirectHandler that affects Red Hat products utilizing vertx-core for HTTP client operations. The vulnerability allows sensitive request headers, such as authentication tokens and session cookies, to be forwarded to arbitrary external domains during HTTP 30x redirects. This could enable an attacker to capture credentials if they can induce a Vert.x HttpClient to redirect to a malicious server, potentially leading to unauthorized access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, configure applications utilizing Vert.x HttpClient to strictly validate and restrict the URLs to which HTTP requests can be redirected. Implement allowlists for trusted domains and ensure that any user-supplied or external URLs processed by Vert.x HttpClient are thoroughly sanitized and validated to prevent redirection to attacker-controlled destinations. This may involve updating application-specific configurations or implementing custom URL validation logic. A service restart or reload may be required for changes to take effect.