Skip to content

Back to the catalog

JFrog Security (@JFrogSecurity) on X
x.comthread

JFrog Security (@JFrogSecurity) on X

JFrog Security announces research on CVE-2026-102479 in Vert.x, which skips validating the letter 'L' in header names and so accepts `Content-Xength` as `Content-Length`. JFrog Research chained this with a dangling-byte primitive to bypass reverse proxy socket validation. They demonstrate end-to-end response poisoning and session fixation behind real reverse proxies. The post links to a full writeup; the tweet itself gives no exploit detail.

TL;DR JFrog shows Vert.x accepting `Content-Xength` as `Content-Length` (CVE-2026-102479), enabling response poisoning and session fixation behind reverse proxies.
Open original ↗

Organisations named here

  • dangling-byte primitive
  • JFrog Research
  • response poisoning

CVEs named here

  • CVE-2026-102479

Technologies named here

  • JFrog
  • Open-source projects built on Vert.x (listed in the JFrog writeup, not named on this page)
  • Vert.x (skips validating the letter 'L' in header names, so Content-Xength is accepted as Content-Length)

Techniques named here

  • Session fixation
  • Dangling-byte primitive
  • HTTP header parsing discrepancy (Content-Xength treated as Content-Length)
  • HTTP response poisoning

Also named here

  • Vert.x

Related in AppSec