CVE-2026-102475: Vulnerability in Eclipse Foundation Eclipse Vert.x

Eclipse Vert.x versions >=5.0.0 <=5.0.12, >=5.1.0 <=5.1.9, and =5.2.0 contain a vulnerability in the io.vertx:vertx-http-proxy component. The HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure bounded buffering per request. However, this mechanism can be abused to force the server to allocate heap memory indefinitely, leading to potential denial of service conditions. Exploitation requires the use of an intercepting body transformer.

Successful exploitation can cause the server to allocate heap memory indefinitely, which may lead to resource exhaustion and denial of service. The CVSS 4.0 base score is 8.7 (high severity), indicating a significant impact on availability without requiring privileges, user interaction, or authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the Eclipse Foundation advisories for updates and consider mitigating exposure by disabling or restricting the use of intercepting body transformers in the HTTP proxy component until a fix is available.