CVE-2026-102475

MediumCVSS 5.9/10Last modified Oct 20, 2026

Description

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer.

The impacted component is io.vertx:vertx-http-proxy.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
Eclipse FoundationEclipse Vert.x>= 5.0.0, <= 5.0.12; >= 5.1.0, <= 5.1.9; 5.2.0

References

Timeline

Published
Oct 15, 2026
Last modified
Oct 20, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1024769.1In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiencyCVE-2026-1024775.9In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable peCVE-2026-1024788.7In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing accessCVE-2026-1024795.9In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well kCVE-2026-102484.7A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System up to 1.0. This issue affects the function create_supplCVE-2026-1024837.5Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS CookieCVE-2026-1024846.4Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time souCVE-2026-1024855.2Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serCVE-2026-1024867.5Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTSCVE-2026-1024888.7In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtaCVE-2026-1024899.8Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bugCVE-2026-102497.3A vulnerability was identified in itsourcecode Online Blood Bank Management System 1.0. Impacted is an unknown function of the file /admin/v
CVE-2026-102475: Medium severity, CVSS 5.9 | Vulnix