CVE-2026-118487

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.35 Eclipse Vert.x versions 5.0.0 through 5.2.2

Description The FrameParser in vertx-stomp creates a RecordParser without defining a maxRecordSize. This allows a peer to stream bytes continuously without a newline character, forcing the parser to accumulate data indefinitely. This issue affects both STOMP servers and clients, enabling a malicious actor to trigger the flaw before or after authentication. Continuous byte streaming exhausts the JVM heap memory, leading to a process crash and a complete denial of service.

Recommendations Update to a version later than 4.5.35 for the 4.x branch. Update to a version later than 5.2.2 for the 5.x branch.