Eclipse Vert.x HTTP Proxy: Denial of service via unbounded heap allocation
Summary
The body transformer interceptor in the Eclipse Vert.x HTTP Proxy library does not correctly enforce its max buffered bytes limit. A remote, unauthenticated attacker can force the server to allocate heap memory indefinitely, which can lead to a denial of service. The flaw only applies when an application uses an intercepting body transformer.
Affected
- io.vertx:vertx-http-proxy 5.0.0 to 5.0.12
- io.vertx:vertx-http-proxy 5.1.0 to 5.1.9
- io.vertx:vertx-http-proxy 5.2.0 (the GHSA advisory lists 5.2.0; the CVE record lists 5.2.0 as unaffected by default)
Fixed in
- 5.1.10 (per the Vert.x 5.1.10 release notes and the GHSA advisory)
- 5.2.1 (per the GHSA advisory)
- 5.0.x: Unknown. Check the GHSA patched versions field.
Workaround
No vendor workaround known.
Interim measures if patching is delayed (not from the vendor): limit request body sizes at an upstream reverse proxy or WAF, apply rate limits, and monitor heap usage and restarts of affected services. Lowering the Vert.x limit may not help, because the flaw lies in how the limit is enforced.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof-of-concept found.
- Exploitation in the wild: Unknown. Not verified against CISA KEV.
- EPSS: 0.00258.
Our recommendation
- Inventory Java applications and dependency trees for vertx-http-proxy in the affected ranges.
- Upgrade to 5.1.10, 5.2.1 or a later fixed version; confirm the fix for 5.0.x in the GHSA advisory.
- Prioritise internet-facing applications that use an intercepting body transformer.
- Ask software vendors whether their products are affected and when they will ship fixes.
- Monitor heap usage and service restarts as an indicator of attack.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-mjwh-5qfp-hjgc github.com
- Eclipse CVE assignment work item 351 gitlab.eclipse.org
- OSV: CVE-2026-102475 osv.dev
- Eclipse Vert.x 5.1.10 release blog vertx.io
- VulDB: CVE-2026-102475 (vuln 420533) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:35.
Original description (NVD)
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer. The impacted component is io.vertx:vertx-http-proxy.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.