CVE-2026-102465

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.34 Eclipse Vert.x versions 5.0.0 through 5.0.12 Eclipse Vert.x versions 5.1.0 through 5.1.9 Eclipse Vert.x version 5.2.0

Description The Redis client RESP parser pre-allocates arrays based on the length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length. This causes the client to attempt a massive heap allocation, resulting in an OutOfMemoryError that crashes the Vert.x event loop thread, leading to a denial of service for all connections and verticles sharing that loop.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.