CVE-2026-102475 in Vert.x
Summary
by MITRE • 10/15/2026
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer.
The impacted component is io.vertx:vertx-http-proxy.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
Eclipse Vert.x versions within the ranges 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and specifically version 5.2.0 contain a critical resource exhaustion vulnerability in its HTTP proxy component, identified as io.vertx:vertx-http-proxy. This flaw resides within the body transformer interceptor mechanism, which is designed to modify request or response bodies during transit. The core technical issue stems from an improper implementation of memory management for buffered data. While the system attempts to enforce a bounded buffer by utilizing a maximum buffered bytes limit, this safeguard fails under specific conditions when intercepting body transformers are active. Consequently, instead of capping memory usage as intended, the vulnerability allows an attacker to force the server to allocate heap space indefinitely without releasing it, leading to unbounded resource consumption.
The operational impact of this vulnerability is severe, primarily manifesting as a Denial of Service (DoS) condition. By exploiting the flaw in the body transformer interceptor, malicious actors can trigger continuous memory allocation on the server side. As the JVM attempts to accommodate these excessive allocations, heap space becomes rapidly depleted. This leads to increased garbage collection overhead, significant latency spikes, and eventually results in an OutOfMemoryError (OOM), causing the application or service to crash or become unresponsive. The requirement for this vulnerability to be exploited via an intercepting body transformer means that it specifically targets deployments where custom HTTP proxy logic is implemented using Vert.x's interceptor framework, making it a targeted threat against specific architectural configurations rather than all generic Vert.x applications.
From a classification perspective, this issue aligns with CWE-789: Memory Allocation with Unlimited Resources and CWE-400: Uncontrolled Resource Consumption. The attack vector leverages the application's own logic for handling HTTP bodies to bypass expected limits, which is characteristic of logical flaws in resource management rather than simple buffer overflows. In terms of adversary tactics, this vulnerability facilitates actions consistent with ATT&CK technique T1498: Network Denial of Service, specifically under the sub-technique of Resource Exhaustion Attacks. The attacker does not need to inject malicious code or exploit a remote code execution flaw but instead abuses the server's legitimate processing capabilities to degrade service availability.
Mitigation strategies must focus on both immediate patching and architectural review. Organizations running affected versions should upgrade Eclipse Vert.x to a version outside the specified vulnerable ranges, ensuring that the latest security patches for the http-proxy module are applied. If upgrading is not immediately feasible, administrators should audit their proxy configurations to identify any usage of body transformer interceptors. Where possible, implementing stricter external rate limiting or request size restrictions at the network edge can help mitigate the impact by preventing large payloads from reaching the vulnerable application layer. Additionally, monitoring heap memory utilization and setting up alerts for abnormal spikes in garbage collection activity can provide early warning signs of such an attack being attempted against unpatched systems.