Eclipse Vert.x: Memory exhaustion via gRPC compression bomb
Summary
The gRPC module of Eclipse Vert.x (vertx-grpc-server) applies the configured maximum message size only to the received compressed bytes, not to the uncompressed content. A remote, unauthenticated attacker can send a compressed message that expands far beyond the limit, forcing the endpoint to allocate more memory than configured. The result is a denial of service through memory exhaustion; code execution or data access is not described. Exposure requires an application that uses this library and runs a gRPC server endpoint.
Affected
- Eclipse Vert.x 4.0.0 to 4.5.34 (vertx-grpc-server)
- Eclipse Vert.x 5.0.0 to 5.0.12 (CVE record; vendor advisory does not list 5.0.x)
- Eclipse Vert.x 5.1.0 to 5.1.8 (vendor advisory; CVE record lists up to 5.1.9)
- Eclipse Vert.x 5.2.0
Fixed in
- 4.5.35
- 5.1.10
- 5.2.1
- 5.0.x: Unknown. No fixed version named by the vendor; confirm with the vendor.
Workaround
- No vendor-documented workaround.
- Interim measure (not from the vendor): limit the decompressed request size at a reverse proxy or gateway, or restrict which clients can reach the gRPC port. Test before use.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- VulDB reports no known exploit; not listed in CISA KEV.
- No public proof of concept or in-the-wild reports found.
- EPSS 0.00318 (low).
Our recommendation
- Search Java dependencies (SBOM, Maven or Gradle files) for io.vertx:vertx-grpc-server and record the exact version.
- Upgrade to 4.5.35, 5.1.10 or 5.2.1 where applicable.
- For 5.0.x, confirm the fixed version with the vendor before assuming it is covered.
- If a gRPC endpoint is internet-facing and cannot be patched promptly, apply the interim measure and monitor for unusually large or slow requests.
- If the endpoint is internal-only or behind authentication, prioritise patching as normal.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4wvq-75mw-q6cg github.com
- Eclipse CVE assignment work item #349 gitlab.eclipse.org
- OSV: CVE-2026-102477 osv.dev
- Fix pull request #379 (vertx-grpc) github.com
- Mend vulnerability database: CVE-2026-102477 www.mend.io
- Tenable: CVE-2026-102477 www.tenable.com
- VulDB: CVE-2026-102477 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:33.
Original description (NVD)
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks. The impacted component is io.vertx:vertx-gprc-server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.