Eclipse Foundation Eclipse Vert.x vulnerabilities

Latest Eclipse Foundation Eclipse Vert.x CVEs

Newest publication first

1. CVE-2026-118487 Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser

   Published 2026-11-03

   High·CVSS 7.5 EPSS 0.66%

   In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the FrameParser in vertx-stomp creates a RecordParser without setting maxRecordSize, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the S...

2. CVE-2026-118488 Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client

   Published 2026-11-03

   Medium·CVSS 5.9 EPSS 0.43%

   In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an EOL-terminated line (not length-prefixed, for example a simple string [1]), we'll keep growing the buffer without bounds, eventually leading to an OOM. We need to have...

3. CVE-2026-118489 CachingWebClient shares user-specific HTTP responses across users via the shared cache tier

   Published 2026-11-03

   High·CVSS 7.5 EPSS 0.34%

   In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one CachingWebClient is shared across users — the documented pattern of a per-user WebClientSession over a shared caching client — a response that is specific to one user but is cacheable and not marked private/no-s...

4. CVE-2026-102477 io.vertx/vertx-grpc-server: vertx-grpc-server: Denial of Service via compression bomb

   Published 2026-10-15

   High·CVSS 8.7 EPSS 0.32%

   In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only app...

5. CVE-2026-102464 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received fro...

   Published 2026-10-15

   High·CVSS 8.2 EPSS 0.31%

   In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map (qos2inbound) while awaiting the corresponding P...

6. CVE-2026-102461 io.vertx/vertx-json-schema: vertx-json-schema: Denial of Service via inefficient uniqueItems array validation

   Published 2026-10-15

   High·CVSS 8.7 EPSS 0.39%

   In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON arr...

7. CVE-2026-103224 io.vertx/vertx-mysql-client: vertx-mysql-client: Denial of Service via unbounded memory allocation during packet decoding

   Published 2026-10-15

   High·CVSS 8.2 EPSS 0.32%

   In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-mid...

8. CVE-2026-103223 io.vertx/vertx-pg-client: vertx-pg-client: Denial of Service via unvalidated message length

   Published 2026-10-15

   High·CVSS 8.2 EPSS 0.32%

   In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle P...

9. CVE-2026-102466 io.vertx/vertx-mysql-client: vertx-mysql-client: Denial of Service via unvalidated column count memory allocation

   Published 2026-10-15

   High·CVSS 8.2 EPSS 0.28%

   In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a server-declared column count with no upper-bound validation. A malicious or compr...

10. CVE-2026-102463 io.vertx/vertx-pg-client: vertx-pg-client: Denial of Service via unbounded array allocation

    Published 2026-10-15

    High·CVSS 8.2 EPSS 0.31%

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious...

11. CVE-2026-102469 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User De...

    Published 2026-10-15

    Critical·CVSS 9.2 EPSS 0.46%

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call wi...

12. CVE-2026-102462 io.vertx/vertx-mssql-client: Vert.x MSSQL client: Denial of Service via unbounded memory allocation during TDS packet processing

    Published 2026-10-15

    High·CVSS 8.2 EPSS 0.32%

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malic...

13. CVE-2026-102465 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enf...

    Published 2026-10-15

    High·CVSS 8.2 EPSS 0.23%

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker i...

14. CVE-2026-102475 io.vertx/vertx-http-proxy: vertx-http-proxy: Denial of Service via unbounded memory allocation in body transformer

    Published 2026-10-15

    High·CVSS 8.7 EPSS 0.26%

    In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate...

15. CVE-2026-102467 io.vertx/vertx-core: Eclipse Vert.x: Denial of Service via unconstrained WebSocket decompression

    Published 2026-10-15

    High·CVSS 8.7 EPSS 0.26%

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. Th...

16. CVE-2026-102471 CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages

    Published 2026-10-14

    Medium·CVSS 6.9 EPSS 0.31%

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence e...

17. CVE-2026-102479 io.vertx/vertx-core: Eclipse Vert.x: HTTP request smuggling via improper header canonicalization

    Published 2026-10-14

    High·CVSS 8.7 EPSS 0.34%

    In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xengt...

18. CVE-2026-102460 io.vertx/vertx-web: vertx-web: Authorization bypass via ChainAuthHandler scope validation failure

    Published 2026-10-14

    High·CVSS 8.6 EPSS 0.27%

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a...

19. CVE-2026-102476 io.vertx/vertx-core: Eclipse Vert.x: Information disclosure via improper SSL context caching

    Published 2026-10-14

    Critical·CVSS 9.1 EPSS 0.23%

    In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask...

20. CVE-2026-15075 vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects

    Published 2026-07-14

    High·CVSS 8.2 EPSS 0.20%

    In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (scheme, host, port) i...

21. CVE-2026-15076 io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation

    Published 2026-07-14

    High·CVSS 8.2 EPSS 0.20%

    In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 se...

22. CVE-2026-6860 Vert.x has a DoS via unbounded server-side SNI SslContext cache growth

    Published 2026-05-06

    Medium·CVSS 6.9 EPSS 0.24%

    A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting *.example.com, any XYZ.example.com where xyz is a valid name can be used.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.