In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on… (CVE-2026-102475)

The vulnerability in Eclipse Vert.x's HTTP proxy (io.vertx:vertx-http-proxy) affects versions 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0. The body transformer interceptor component relies on a maximum buffered bytes limit to ensure bounded memory usage per request. Due to improper enforcement or design, an attacker can force the server to allocate heap memory indefinitely, potentially causing resource exhaustion and denial of service. Exploitation requires the presence and use of an intercepting body transformer in the HTTP proxy.

This vulnerability can cause a denial-of-service condition by forcing the server to allocate heap memory indefinitely, exhausting server resources. There is no impact on confidentiality or integrity reported. The attack requires network access and has a high attack complexity (AC:H) with no privileges or user interaction needed. The CVSS v3.1 score is 5.9 (medium-high severity).

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the intercepting body transformer feature in the HTTP proxy component or apply any recommended configuration changes from the vendor advisory to limit exposure.