CVE-2026-102467

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is io.vertx:vertx-core.

Vendor	eclipse foundation
Product	eclipse vert.x
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse vert.x

Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse vert.x are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / Eclipse Vert.x

4.0.0 ≤ 4.5.34 5.0.0 ≤ 5.0.12 5.1.0 ≤ 5.1.9 5.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-h722-h6c2-6j3c gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/341

Credits

Mike Read