Mike Read

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist. This code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). However, DB2 does not support this type of UDT. The FDOCA 0x50 type is never sent by a legitimate DB2 server. Nevertheless, a malicious or man-in-the-middle DRDA server could craft a response with a 0x50-tagged column, causing the client to deserialize arbitrary attacker-controlled bytes on the Vert.x event loop before any application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this enables remote code execution. Without a gadget chain, denial of service is possible via crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible. The impacted component is io.vertx:vertx-db2-client.

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END OF MESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-mssql-client.

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL server, or an on-path attacker intercepting an unencrypted connection, can send a crafted DataRow message with an excessively large array dimension value, causing the client to attempt a multi-gigabyte heap allocation and crash with an OutOfMemoryError. The impacted component is io.vertx:vertx-pg-client.

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a server-declared column count with no upper-bound validation. A malicious or compromised MySQL server, or an attacker with man-in-the-middle positioning, can send a crafted result set packet with an extremely large column count, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Netty event loop thread, causing a complete denial of service for all connections and verticles in the Vert.x application. The impacted component is io.vertx:vertx-mysql-client.

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks. The impacted component is io.vertx:vertx-gprc-server.

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Vert.x event loop thread, denying service to all connections and verticles sharing that loop. The impacted component is io.vertx:vertx-mysql-client.

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is io.vertx:vertx-core.

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer. The impacted component is io.vertx:vertx-http-proxy.

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time, leading to denial of service. The impacted component is io.vertx:vertx-json-schema. The following Vert.x modules depend on vertx-json-schema and are also affected: io.vertx:vertx-web-openapi-router io.vertx:vertx-web-validation io.vertx:vertx-openapi

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (r) or LF ( ) characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value passed to MailMessage.addHeader(), MailMessage.setHeaders(), MailAttachment.addHeader(), or MailAttachment.setHeaders() is written verbatim to the wire, allowing an attacker to inject arbitrary headers (e.g. Bcc, Reply-To, Content-Type) or prepend body content to the outgoing message. The same weakness affects MIME part metadata set via MailAttachment.setContentType(), setDisposition(), setDescription(), and setContentId(), which are written directly into MIME part headers without validation. A secondary weakness in Utils.mustEncode(char) additionally allows a bare LF in a From display-name to bypass Q-encoding and reach the wire unchanged. An unauthenticated attacker who can control any header name, header value, or attachment metadata field passed to the mail client (for example via a web form or API that feeds into MailMessage) can exploit this to redirect email copies, spoof headers, or tamper with message structure. The impacted component is io.vertx:vertx-mail-client.

**اسم البرنامج المتأثر والإصدارات المتأثرة** Eclipse Vert.x الإصدارات من 5.0.0 إلى 5.0.12 Eclipse Vert.x الإصدارات من 5.1.0 إلى 5.1.9 Eclipse Vert.x الإصدار 5.2.0 **Description** يعتمد عميل HTTP في Vert.x ضمن مكون `io.vertx:vertx-core` على ذاكرة تخزين مؤقت لسياق SSL لغرض الكفاءة. لا يعكس مفتاح ذاكرة التخزين هذه بشكل كامل دلالات SSL المطلوبة، مما قد يسمح للعميل بالحصول على سياق SSL بخصائص أمنية أضعف مما تم طلبه، مثل الحصول على سياق يتجاهل التحقق من اسم المضيف بينما كان المطلوب سياقاً يقوم بالتحقق. **Recommendations** في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة.

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as Content-Length. This can be exploited for request smuggling purpose. The impacted component is io.vertx:vertx-core.

**Name of the Vulnerable Software and Affected Versions** Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 **Description** The FIQL query parser contains a flaw in its operator search mechanism. When processing a long string that lacks an operator, the search pattern attempts numerous combinations, leading to excessive CPU consumption. This can be exploited by sending a crafted query to exhaust server resources, which may degrade performance or cause a denial of service for other requests. **Recommendations** Upgrade to version 4.2.4. Upgrade to version 4.1.9. Upgrade to version 3.6.13.

**Name of the Vulnerable Software and Affected Versions** Apache HTTP Server versions 2.4.0 through 2.4.68 **Description** An improper privilege management issue exists in the `mod ssl` module. The flaw occurs when using `SSLRequire` in conjunction with file-related expressions via `ap expr` file functions, which can lead to improper privilege escalation without requiring authentication. **Recommendations** Update Apache HTTP Server to a version later than 2.4.68.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M14 through 11.0.25 Apache Tomcat versions 10.1.22 through 10.1.59 Apache Tomcat versions 9.0.92 through 9.0.121 **Description** CLIENT CERT authentication does not fail as expected in certain scenarios when the soft fail option is disabled. **Recommendations** Upgrade to version 11.0.26. Upgrade to version 10.1.60. Upgrade to version 9.0.122.

**Name of the Vulnerable Software and Affected Versions** Apache Artemis versions 2.50.0 through 2.56.0 Apache ActiveMQ Artemis versions 1.3.0 through 2.44.0 **Description** When processing message-based management requests from an authenticated client with MANAGE permissions, the broker may trigger Java deserialization of specific method parameters that are not utilized. An attacker can craft a payload using permitted types to cause excessive computation and pin the processing thread, resulting in a denial of service. **Recommendations** Upgrade Apache Artemis to version 2.57.0. Upgrade Apache ActiveMQ Artemis to version 2.57.0.

**Name of the Vulnerable Software and Affected Versions** Apache Artemis versions 2.50.0 through 2.56.0 Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 **Description** An authenticated client can attach a consumer using a selector with crafted wildcard usage. This causes excessive evaluation during message delivery attempts, which occupies a shared broker thread and results in a denial of service. **Recommendations** Upgrade Apache Artemis to version 2.57.0. Upgrade Apache ActiveMQ Artemis to version 2.57.0.

**Name of the Vulnerable Software and Affected Versions** Apache Artemis versions 2.50.0 through 2.56.0 Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 **Description** An unauthenticated remote attacker can create arbitrary durable queues using the CORE protocol. This allows for unauthorized manipulation of the broker state and may result in a denial of service. **Recommendations** Upgrade Apache Artemis to version 2.57.0. Upgrade Apache ActiveMQ Artemis to version 2.57.0.

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.