CVE-2026-102467

MediumCVSS 5.9/10Last modified Oct 20, 2026

Description

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb.

The impacted component is io.vertx:vertx-core.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
Eclipse Foundation	Eclipse Vert.x	>= 4.0.0, <= 4.5.34; >= 5.0.0, <= 5.0.12; >= 5.1.0, <= 5.1.9; 5.2.0

References

https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-h722-h6c2-6j3cVendor Advisory
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/341Issue Tracking, Third Party Advisory

Timeline

Published: Oct 15, 2026
Last modified: Oct 20, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1024695.9In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) co CVE-2026-102473.5A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This vulnerability affects the function create_generic_CVE-2026-1024715.9In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR CVE-2026-1024735.5A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate CVE-2026-1024744.0A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can n CVE-2026-1024755.9In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that re CVE-2026-1024769.1In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency CVE-2026-1024775.9In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable pe CVE-2026-1024788.7In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access CVE-2026-1024795.9In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well k CVE-2026-102484.7A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System up to 1.0. This issue affects the function create_suppl CVE-2026-1024837.5Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie