Eclipse Vert.x Redis client: Denial of service via unbounded RESP allocation
Summary
The Redis client of Eclipse Vert.x pre-allocates arrays to the length declared by the Redis server in RESP responses, without an upper limit. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted response that triggers a massive heap allocation. The resulting OutOfMemoryError crashes the event loop thread, which disrupts all connections and verticles sharing that loop. Confidentiality and integrity are not affected.
Affected
- Eclipse Vert.x Redis client (vertx-redis-client) 4.0.0 to 4.5.34
- 5.0.0 to 5.0.12 (5.0.x not listed as patched in the advisory; status unknown)
- 5.1.0 to 5.1.8 (the CVE record also lists 5.1.9, which the vendor release notes say should not be used)
- 5.2.0
- Note: the CVE record names io.vertx:vertx-mysql-client, which conflicts with the advisory; the Redis client is the affected component according to the advisory and description.
Fixed in
- 4.5.35
- 5.1.10
- 5.2.1
- 5.0.x: no fixed version listed; unknown.
Workaround
Unknown.
- No vendor workaround is documented.
Exploitation
- No known exploitation in the wild.
- Not listed in the CISA KEV catalog.
- EPSS about 0.00232.
- No public proof of concept found; the fix (PR #585) is public, so n-day exploitation is possible.
Our recommendation
- Upgrade vertx-redis-client to 4.5.35, 5.1.10 or 5.2.1; for 5.0.x, contact Eclipse or move to a fixed branch.
- Check applications and SBOMs for vertx-redis-client, including downstream dependencies.
- Ensure Redis connections use TLS and trusted network paths, and restrict which Redis servers the application can reach.
- Prioritise medium; escalate if a Redis server is reachable over untrusted networks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4wf9-p5hg-98w5 github.com
- Eclipse CVE assignment work item #343 gitlab.eclipse.org
- Eclipse Vert.x 5.1.10 release blog vertx.io
- Fix pull request #585 (vertx-redis-client) github.com
- VulDB CVE-2026-102465 vuldb.com
- Vulners PT-2026-114823 vulners.com
- OpenCVE CVE-2026-102465 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:07.
Original description (NVD)
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Vert.x event loop thread, denying service to all connections and verticles sharing that loop. The impacted component is io.vertx:vertx-mysql-client.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.