CVE-2026-102477CWE-409
CVE-2026-102477
Medium · published October 15, 2026
What it is
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks.
The impacted component is io.vertx:vertx-gprc-server.
The record
Technical detail
- CVSS v3.1
- 5.9 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v4.0
- 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.00318 · 23.5th percentile
- Weakness
- CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
- Published
- 2026-10-15T13:17Z
Affected products (3)
| Product | Versions | Fixed in |
|---|
| eclipse/vert.x | ≥ 4.5.0, < 4.5.35 | 4.5.35 |
| eclipse/vert.x | ≥ 5.0.0, < 5.2.0 | 5.2.0 |
| eclipse/vert.x | all versions | — |
References (2)
EPSS history
Timeline
16 OCT 03:27Z
EPSS moved — → 0%
epss
15 OCT 08:28Z
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum…
cvelistv5
15 OCT 08:28Z
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum…
cvelistv5