Description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb.



The impacted component is io.vertx:vertx-core.
Published: 2026-10-15
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:vert.x:5.2.0:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Mon, 19 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Title Unbounded WebSocket Decompression Allows Zip Bomb Denial of Service

Mon, 19 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse vert.x
Vendors & Products Eclipse
Eclipse vert.x

Thu, 15 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is io.vertx:vertx-core.
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Eclipse Vert.x
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-10-15T14:37:49.556Z

Reserved: 2026-09-29T08:30:11.627Z

Link: CVE-2026-102467

cve-icon Vulnrichment

Updated: 2026-10-15T14:36:25.651Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-15T08:16:36.670

Modified: 2026-10-20T19:30:37.930

Link: CVE-2026-102467

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T16:30:13Z

Weaknesses