CVE-2026-102475

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer. The impacted component is io.vertx:vertx-http-proxy.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-25)

CWE

CWE-770

Published

2026-10-15

Modified

2026-10-20

Record from

the NVD, synced 2026-10-21

Affected

• eclipse:vert.x

References

• https://github.com/eclipse-vertx/vertx-http-proxy/security/advisories/GHSA-mjwh-5qfp-hjgc
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/351

Check your stackJSON