Eclipse Vert.x: Denial of service via unbounded decompression in WebSockets
Summary
Eclipse Vert.x, a Java toolkit embedded in applications through the io.vertx:vertx-core library, does not limit the memory allocated when decompressing WebSocket frames and messages. A remote attacker can send a compressed zip bomb payload to exhaust resources and cause a denial of service. No authentication or user interaction is required, and the impact is limited to availability. Exposure depends on whether an application using an affected version accepts compressed WebSocket traffic.
Affected
- io.vertx:vertx-core 4.0.0 to 4.5.34
- io.vertx:vertx-core 5.0.0 to 5.1.8 according to the vendor advisory; the CVE record also lists 5.0.x up to 5.0.12 and 5.1.9
- io.vertx:vertx-core 5.2.0
Fixed in
- 4.5.35 (4.x line)
- 5.1.10 (5.1.x line)
- 5.2.1 (5.2.x line)
- Unknown for the 5.0.x line.
Workaround
- No vendor workaround documented; the vendor advisory points to upgrading.
- Analyst suggestion: if the application does not need WebSocket compression, disable it until patching is complete; confirm with the development team.
- Analyst suggestion: where possible, enforce request size limits in a reverse proxy or load balancer in front of the service.
Exploitation
- CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
- No evidence of exploitation in the wild found; one source lists it as not in KEV.
- No public proof of concept found; the public fix commit describes the mechanism.
Our recommendation
- Inventory io.vertx:vertx-core versions in own applications and vendor products using SBOMs and dependency scans.
- Upgrade to 4.5.35, 5.1.10 or 5.2.1 depending on the branch.
- Ask Eclipse to confirm the fix status for the 5.0.x line and the 5.1.9 discrepancy.
- Prioritise internet-facing services that use WebSockets with compression enabled.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-h722-h6c2-6j3c github.com
- Eclipse CVE assignment work item #341 gitlab.eclipse.org
- OSV entry CVE-2026-102467 osv.dev
- Eclipse Vert.x fix pull request #6412 github.com
- VulDB entry CVE-2026-102467 vuldb.com
- Web3signer pull request #1268 (downstream fix to Vert.x 5.2.2) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:34.
Original description (NVD)
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is io.vertx:vertx-core.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.