CVE-2026-118488

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.35 Eclipse Vert.x versions 5.0.0 through 5.2.2

Description A flaw exists where a malicious server can cause an Out of Memory (OOM) condition by continuously sending bytes on an EOL-terminated line that lacks a length prefix. Additionally, a specially crafted RESP response, such as a bulk string missing a CRLF trailer, can cause the parser to enter an infinite loop. This loop repeatedly parses the same buffer and pushes the same response to the caller, which may also result in an OOM if the consumer buffers the responses.

Recommendations Update Eclipse Vert.x to a version later than 4.5.35. Update Eclipse Vert.x to a version later than 5.2.2.