CVE-2026-102467

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.34 Eclipse Vert.x versions 5.0.0 through 5.0.12 Eclipse Vert.x versions 5.1.0 through 5.1.9 Eclipse Vert.x version 5.2.0

Description The WebSocket implementation in the io.vertx:vertx-core component fails to define a maximum byte allocation limit during the decompression of frames or messages. This flaw allows for Distributed Denial of Service (DDOS) attacks using a zip bomb, which is a malicious archive file designed to crash or freeze the system that extracts the file by consuming excessive memory or disk space.

Recommendations Update Eclipse Vert.x versions 4.0.0 through 4.5.34 to a version newer than 4.5.34. Update Eclipse Vert.x versions 5.0.0 through 5.0.12 to a version newer than 5.0.12. Update Eclipse Vert.x versions 5.1.0 through 5.1.9 to a version newer than 5.1.9. Update Eclipse Vert.x version 5.2.0 to a version newer than 5.2.0.