In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per… (CVE-2026-102477)

In Eclipse Vert.x versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0, the gRPC endpoint configuration limits the maximum size of received messages based on the compressed byte size. However, this limit does not account for the uncompressed message size, which can be significantly larger. An attacker can exploit this by sending a compressed message that decompresses to a much larger size, forcing the server to allocate more memory than intended. This vulnerability is classified under CWE-409 (Improper Management of Critical Resource).

The vulnerability can lead to denial of service by causing the gRPC endpoint to allocate excessive memory when processing compressed messages that decompress to large sizes. This can degrade service availability or crash the server. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting the acceptance of compressed messages or implementing additional application-level controls to detect and mitigate compression bomb attacks.