Threats Tagged 'ghsa-2fhm-447p-jh2m'

Eclipse Vert.x versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 contain a vulnerability in the Redis client RESP parser. The parser pre-allocates arrays based on server-declared lengths without enforcing an upper bound. A malicious or compromised Redis server or a man-in-the-middle attacker can exploit this by sending a crafted RESP response with an extremely large array length, causing excessive memory allocation and crashing the Vert.x event loop thread. This results in denial of service for all connections and verticles sharing that event loop.