CVE-2026-102477

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.34 Eclipse Vert.x versions 5.0.0 through 5.0.12 Eclipse Vert.x versions 5.1.0 through 5.1.9 Eclipse Vert.x version 5.2.0

Description The io.vertx:vertx-gprc-server component contains an issue where the configurable per-message maximum size for a gRPC endpoint is applied only to the received compressed bytes rather than the actual uncompressed content. This allows an attacker to trigger a compression bomb attack, forcing the endpoint to allocate significantly more memory than the configured limit during decompression.

Recommendations Update Eclipse Vert.x versions 4.0.0 through 4.5.34 to a version newer than 4.5.34. Update Eclipse Vert.x versions 5.0.0 through 5.0.12 to a version newer than 5.0.12. Update Eclipse Vert.x versions 5.1.0 through 5.1.9 to a version newer than 5.1.9. Update Eclipse Vert.x version 5.2.0 to a version newer than 5.2.0.