CVE-2026-102477: fallo de gravedad alta en Eclipse Vert.x
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.3%
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks.
The impacted component is io.vertx:vertx-gprc-server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
Eclipse Foundation · Eclipse Vert.xCVEs relacionadas — Eclipse Vert.x
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-118487HIGHHeap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParserEPSS 0.7%CVE-2024-8391MEDIUMEclipse Vert.x gRPC server does not limit the maximum message sizeEPSS 0.6%CVE-2026-102469CRITICALCVE-2026-102469EPSS 0.5%CVE-2026-118488MEDIUMHeap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis clientEPSS 0.4%CVE-2026-102461HIGHCVE-2026-102461EPSS 0.4%CVE-2026-118489HIGHCachingWebClient shares user-specific HTTP responses across users via the shared cache tierEPSS 0.3%