CVE-2026-102465
8.2HighPublished 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-770
Impact
A malicious or compromised Redis server, or a network attacker in a man-in-the-middle position, can crash the Vert.x event loop via an OutOfMemoryError, causing a denial of service across all shared connections and verticles.
Root cause
The Redis RESP parser allocates memory based directly on the array length declared by the server without validating upper bounds.
Affected systems
Eclipse Vert.x Redis client (io.vertx:vertx-redis-client) versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 (note: advisory description text also erroneously lists io.vertx:vertx-mysql-client).
CVSS v4.0 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade to a fixed release outside the affected ranges (e.g., > 4.5.34, > 5.0.12, > 5.1.9, or > 5.2.0). If you cannot patch immediately, ensure Redis connections enforce TLS to prevent man-in-the-middle tampering and isolate Redis network access.
$ mvn dependency:tree -Dincludes=io.vertx:vertx-redis-clientAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Vert.x event loop thread, denying service to all connections and verticles sharing that loop. The impacted component is io.vertx:vertx-mysql-client.