CVE-2026-102475

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer. The impacted component is io.vertx:vertx-http-proxy.

Vendor	eclipse foundation
Product	eclipse vert.x
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse vert.x

Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse vert.x are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / Eclipse Vert.x

5.0.0 ≤ 5.0.12 5.1.0 ≤ 5.1.9 5.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/eclipse-vertx/vertx-http-proxy/security/advisories/GHSA-mjwh-5qfp-hjgc gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/351

Credits

Mike Read