{"metadata": {"vulnerability": "CVE-2026-102471", "count": 18, "kinds": {"milestone": 6, "sighting": 2, "kev": 0, "other": 10}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-29T08:34:19.768Z", "date_only": false, "value": "2026-09-29T08:34:19.768Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-102471", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T18:50:21.647Z", "date_only": false, "value": "2026-10-14T18:50:21.647Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-102471", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-14T18:50:21.647Z", "date_only": false, "value": "2026-10-14T18:50:21.647Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / eclipse", "record": "CVE-2026-102471", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:17:05Z", "date_only": false, "value": "2026-10-14T19:17:05Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-762Q-Q3HX-6C35", "record": "GHSA-762Q-Q3HX-6C35", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-14T19:17:05.180Z", "date_only": false, "value": "2026-10-14T19:17:05.180", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102471", "record": "FKIE_CVE-2026-102471", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-14T19:48:33.466Z", "date_only": false, "value": "2026-10-14T19:48:33.466581Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-102471", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T19:48:33.466Z", "date_only": false, "value": "2026-10-14T19:48:33.466581Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102471", "record": "FKIE_CVE-2026-102471", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-14T19:49:35.803Z", "date_only": false, "value": "2026-10-14T19:49:35.803Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-102471", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:49:35.803Z", "date_only": false, "value": "2026-10-14T19:49:35.803Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-102471", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:58:16.025Z", "date_only": false, "value": "2026-10-14T19:58:16.025715Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ehbnbp4mcm6ti", "record": "CVE-2026-102471", "field": "creation_timestamp", "uuid": "2d74ae84-badd-4ac2-b523-77a80c6ffd1f", "content": "CVE-2026-102471 - CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages\nCVE ID : CVE-2026-102471\n \n Published : Oct. 14, 2026, 6:50 p.m. | 38\u00a0minutes ago\n \n Description : In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/ehbnbp4mcm6ti"}, {"timestamp": "2026-10-14T21:33:42Z", "date_only": false, "value": "2026-10-14T21:33:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-762Q-Q3HX-6C35", "record": "GHSA-762Q-Q3HX-6C35", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-15T00:04:04.134Z", "date_only": false, "value": "2026-10-15T00:04:04.134639Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441995972122087", "record": "CVE-2026-102471", "field": "creation_timestamp", "uuid": "4f192b16-a90b-4b50-9f92-9970629f5946", "content": "CVE-2026-102471 CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\\r) or LF (\\n) characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value passed to MailMessage.addHeader(), MailMessage.setHeaders(), MailAttachment.addHeader(), or MailAttachment.setHeaders() is written verbatim to the wire, allowing an attacker to inject arbitrary headers (e.g. Bcc, Reply-To, Content-Type) or prepend body content to the outgoing message.\nThe same weakness affects MIME part metadata set via MailAttachment.setContentType(), setDisposition(), setDescription(), and setContentId(), which are written directly into MIME part headers without validation.\nA secondary weakness in Utils.mustEncode(char) additionally allows a bare LF in a From display-name to bypass Q-encoding and reach the wire unchanged.\nAn unauthenticated attacker who can control any header name, header value, or attachment metadata field passed to the mail client (for example via a web form or API that feeds into MailMessage) can exploit this to redirect email copies, spoof headers, or tamper with message structure.\nThe impacted component is io.vertx:vertx-mail-client.\nhttps://www.cve.org/CVERecord?id=CVE-2026-102471https://github.com/vert-x3/vertx-mail-client/security/advisories/GHSA-rm5c-2c7f-gc5ghttps://gitlab.eclipse.org/security/cve-assignment/-/work_items/348#eclipse #EclipseFoundation #EclipseVert.x#CVE_2026_102471#bot", "url": "https://infosec.exchange/users/cve/statuses/117441995972122087"}, {"timestamp": "2026-10-20T19:32:25.090Z", "date_only": false, "value": "2026-10-20T19:32:25.090", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102471", "record": "FKIE_CVE-2026-102471", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-20T21:30:37Z", "date_only": false, "value": "2026-10-20T21:30:37Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-762Q-Q3HX-6C35", "record": "GHSA-762Q-Q3HX-6C35", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-21T00:00:00Z", "date_only": true, "value": "2026-10-21", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1385", "record": "CERTFR-2026-AVI-1385", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1385", "record": "CERTFR-2026-AVI-1385", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1385", "record": "CERTFR-2026-AVI-1385", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1385", "record": "CERTFR-2026-AVI-1385", "field": "revisions.0.revision_date", "linked_record": true}], "metrics": {"as_of": "2026-11-11T16:35:51.769Z", "anchors": {"origin": {"timestamp": "2026-10-14T18:50:21.647Z", "date_only": false, "value": "2026-10-14T18:50:21.647Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-102471", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-14T18:50:21.647Z", "date_only": false, "value": "2026-10-14T18:50:21.647Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-102471", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2411130.122855, "hours": 669.7583674597223, "days": 27.906598644155096, "min_seconds": 2411130.122855, "max_seconds": 2411130.122855, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-14T18:50:21.647Z", "date_only": false, "value": "2026-10-14T18:50:21.647Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-102471", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T16:35:51.769Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}