CVE-2026-102477: Vulnerability in Eclipse Foundation Eclipse Vert.x
Description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks. The impacted component is io.vertx:vertx-gprc-server.
CVSS v4.0
Score 8.7high
Affected software
Eclipse Foundation
Eclipse Vert.x
pkg:maven/io.vertx/vertx-grpc-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Eclipse Vert.x versions >=4.0.0 <=4.5.34, >=5.0.0 <=5.0.12, >=5.1.0 <=5.1.9, and =5.2.0 contain a vulnerability in the gRPC server component where the per-message maximum size configuration applies only to the compressed message size. This allows an attacker to send compressed messages that decompress to a size larger than the configured limit, forcing the server to allocate more memory than intended. This can be exploited to launch compression bomb attacks against the gRPC endpoint, potentially leading to resource exhaustion.
Potential Impact
The vulnerability can be exploited to cause the gRPC endpoint to allocate excessive memory by sending specially crafted compressed messages that decompress to a size larger than the configured maximum. This can lead to denial of service conditions due to resource exhaustion. The CVSS 4.0 score is 8.7 (high severity), indicating a significant impact with no required privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of the vulnerable gRPC endpoints and monitoring for abnormal memory usage patterns related to gRPC traffic. Avoid relying solely on the compressed message size limit as a defense.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-09-29T08:41:02.382Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad090022cdf04f656196488
Added to database: 10/15/2026, 08:34:10 UTC
Last enriched: 10/15/2026, 08:48:28 UTC
Last updated: 10/15/2026, 19:00:27 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.