8.7
High
CVE-2026-102475 In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer…
Description
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer. The impacted component is io.vertx:vertx-http-proxy.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse Vert.x | 5.2.0 | No fix stated |
| Eclipse Vert.x 5.1 | 5.1.0 → 5.1.9 | No fix stated |
| Eclipse Vert.x 5.0 | 5.0.0 → 5.0.12 | No fix stated |
Other CVEs of Eclipse Vert.x
The 23 CVEs of Eclipse Vert.x →
CVE-2026-118487
In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates…
7.5
High
CVE-2026-118488
In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an…
5.9
Medium
CVE-2026-118489
In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the…
7.5
High
CVE-2026-102477
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does…
8.7
High