CVE-2024-8391mediumCWE-770

CVE-2024-8391: falha de média gravidade em Eclipse Vert.x

Eclipse Vert.x gRPC server does not limit the maximum message size

Publicada em

Seguir esta CVE+ Monitorar Eclipse Vert.x+ Monitorar io.vertx:vertx-grpc-client

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.6%
In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client).  This is fixed in the 4.5.10 version.  Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
Eclipse Foundation · Eclipse Vert.x
CVEs relacionadas — Eclipse Vert.x

No mesmo produto, das mais perigosas para as menos.

CVE-2026-118487HIGHHeap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParserEPSS 0.7%CVE-2026-102469CRITICALCVE-2026-102469EPSS 0.5%CVE-2026-118488MEDIUMHeap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis clientEPSS 0.4%CVE-2026-102461HIGHCVE-2026-102461EPSS 0.4%CVE-2026-118489HIGHCachingWebClient shares user-specific HTTP responses across users via the shared cache tierEPSS 0.3%CVE-2026-102479HIGHCVE-2026-102479EPSS 0.3%