6.9
Medium
CVE-2024-8391 In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven…
Description
In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client). This is fixed in the 4.5.10 version. Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse Vert.x 4.3 | 4.3.0 → < 4.5.10 | 4.5.10 |
| vert.x 4.3 | 4.3.0 → < 4.5.10 | 4.5.10 |
Other CVEs of Eclipse Vert.x
The 23 CVEs of Eclipse Vert.x →
CVE-2026-118487
In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates…
7.5
High
CVE-2026-118488
In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an…
5.9
Medium
CVE-2026-118489
In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the…
7.5
High
CVE-2026-102477
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does…
8.7
High