Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.
CVE-2026-93649 is a high-severity vulnerability in the Eclipse Foundation Adoptium Temurin website. The issue arises from improper validation of a redirect URL on the post-download page, which uses a naive string prefix check vulnerable to bypass via dot-segment normalization. This allows an attacker to craft a URL that appears to redirect to a trusted domain but actually leads to an attacker-controlled location, causing users to unknowingly download malicious binaries.
CVE-2026-110723 affects the Eclipse Connected Services Platform's api-gateway component in versions 1.1.1 through 1.7.3. The default rate-limit key resolver uses the leftmost element of the X-Forwarded-For header to identify clients, but this header value is not validated against trusted proxies. This allows an attacker to bypass rate limiting by supplying unique header values, effectively obtaining unlimited independent rate-limit buckets.
CVE-2026-110724 is a vulnerability in Eclipse Connected Services Platform's api-gateway component up to version 1.7.3. The default rate-limit key resolver uses the leftmost element of the X-Forwarded-For header to identify clients, but this header value is not validated against trusted proxies. This allows an attacker to bypass rate limiting by supplying unique header values, effectively obtaining unlimited independent rate-limit buckets.
CVE-2026-110726 affects Eclipse Connected Services Platform's api-gateway component up to version 1.7.3. The default rate-limit key resolver uses the leftmost element of the X-Forwarded-For header, which is attacker-controlled and not validated against trusted proxies. This allows attackers to bypass request-rate limiting by using unique header values to create unlimited independent rate-limit buckets.
CVE-2026-77711 is a high-severity information exposure vulnerability in Eclipse Jetty's HttpClient. When making requests through a forward proxy, if the server responds with a 407 Proxy Authentication Required status, the client incorrectly treats this as a proxy challenge and resends the request with proxy authentication headers. This causes the proxy credentials to be sent to the server, exposing sensitive authentication information.
CVE-2026-76184 is a high-severity vulnerability in Eclipse Jetty's HttpClient where improper path normalization in redirects can cause authentication credentials to be sent to unintended paths. Specifically, if a redirect contains a path like '/secure/../evil', HttpClient matches credentials against '/secure' instead of normalizing to '/evil', potentially exposing the Authorization header to an attacker-controlled path on the same domain.
CVE-2026-76182 is a medium severity vulnerability in Eclipse Jetty where the TryPathsHandler and TryFilesFilter components improperly handle URI path characters when forwarding requests to template URIs. This causes reserved characters in URI queries to be misinterpreted as multiple query parameters instead of a single parameter value.
CVE-2026-102477 is a high-severity vulnerability in Eclipse Vert.x affecting versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and version 5.2.0. The issue arises because the gRPC endpoint's configurable maximum message size limit applies only to the compressed message size, not the uncompressed content size. This discrepancy allows an attacker to exploit compression bomb attacks, causing the endpoint to allocate more memory than intended.
Eclipse Vert.x MQTT client versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 have a vulnerability where inbound QoS 2 PUBLISH messages are stored indefinitely in an internal map without size limits. A malicious MQTT broker can exploit this by sending many distinct QoS 2 PUBLISH messages and withholding PUBREL packets, causing unbounded memory growth and potential application degradation or out-of-memory crashes.
CVE-2026-102461 is a high-severity vulnerability in Eclipse Vert.x affecting versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and version 5.2.0. The issue lies in the uniqueItems keyword validation within the vertx-json-schema component, which uses an inefficient O(n²) pairwise comparison without short-circuiting or size limits. This allows a remote unauthenticated attacker to cause a denial of service by submitting a moderately-sized JSON array that consumes excessive CPU resources. Several Vert.x modules depending on vertx-json-schema are also affected. No patch information is provided, and no known exploits are reported in the wild.
CVE-2026-103224 is a high-severity vulnerability in Eclipse Vert.x's MySQL client component. It affects versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and version 5.2.0. The vulnerability arises from the MySQL message decoder aggregating inbound multi-packet payloads into a composite direct-memory buffer without enforcing a cumulative size limit. A malicious or compromised MySQL server can exploit this by sending a continuous stream of maximum-length packets, preventing the end-of-message condition and causing unbounded memory allocation on the client, leading to an out-of-memory crash before authentication completes.
CVE-2026-103223 is a high-severity vulnerability in Eclipse Vert.x's PostgreSQL client (io.vertx:vertx-pg-client). In affected versions, the PostgreSQL message decoder reads a 4-byte message length field without validating its maximum size. A malicious or compromised PostgreSQL server can send a message with an extremely large length value, causing unbounded memory allocation on the client and potentially leading to an out-of-memory crash before authentication completes.
Eclipse Vert.x versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and version 5.2.0 contain a vulnerability in the vertx-mysql-client component. The client pre-allocates an array for column definitions based on a server-declared column count without validating an upper bound. A malicious or compromised MySQL server or a man-in-the-middle attacker can exploit this by sending a result set with an extremely large column count, causing an OutOfMemoryError that crashes the Netty event loop thread and results in a denial of service for all connections and verticles in the application.
CVE-2026-102463 is a high-severity vulnerability in Eclipse Vert.x's vertx-pg-client component. It affects versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and version 5.2.0. The issue arises from the binary array decoder allocating a Java array based on a server-declared 32-bit dimension count without an upper bound. A malicious PostgreSQL server or an attacker intercepting unencrypted connections can exploit this to cause excessive memory allocation, leading to an OutOfMemoryError crash in the client.
CVE-2026-102469 is a critical vulnerability in Eclipse Vert.x's DB2 client component (vertx-db2-client) affecting versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and version 5.2.0. The vulnerability arises from unsafe deserialization of User Defined Type (UDT) column data using Java's ObjectInputStream.readObject() without any filtering or class allowlisting. This unsafe deserialization can be triggered by a malicious or man-in-the-middle DRDA server sending a crafted response with a 0x50-tagged column, which legitimate DB2 servers do not send. Exploitation can lead to remote code execution if a suitable Java deserialization gadget chain is present, or denial of service otherwise. TLS is disabled by default, increasing the risk of man-in-the-middle attacks.
Eclipse Vert.x versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and version 5.2.0 contain a vulnerability in the vertx-mssql-client component. The TDS message decoder aggregates inbound TDS packets into a composite direct-memory buffer without a cumulative size limit. A malicious or compromised SQL Server can exploit this by sending continuous TDS packets without the END_OF_MESSAGE flag, causing unbounded memory allocation and an out-of-memory crash before authentication completes.
Eclipse Vert.x versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 contain a vulnerability in the Redis client RESP parser. The parser pre-allocates arrays based on server-declared lengths without enforcing an upper bound. A malicious or compromised Redis server or a man-in-the-middle attacker can exploit this by sending a crafted RESP response with an extremely large array length, causing excessive memory allocation and crashing the Vert.x event loop thread. This results in denial of service for all connections and verticles sharing that event loop.
CVE-2026-102475 is a high-severity vulnerability in Eclipse Vert.x HTTP proxy component versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0. The issue arises from the body transformer interceptor relying on a maximum buffered bytes limit to bound request buffers, which can be exploited to cause indefinite heap allocation. This vulnerability requires the use of an intercepting body transformer to be triggered.
Eclipse Vert.x versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and version 5.2.0 contain a vulnerability in their WebSocket implementation. The issue arises because there is no defined maximum byte allocation when decompressing frames or messages, which can be exploited to conduct denial-of-service (DoS) attacks using zip bombs.