CVE-2026-102467
8.7HighPublished 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-770
Impact
Remote, unauthenticated attackers can crash your service via denial of service using a compression bomb. They only need network access to send compressed WebSocket frames.
Root cause
The WebSocket implementation does not limit memory allocation when decompressing incoming compressed frames or messages.
Affected systems
Eclipse Vert.x (io.vertx:vertx-core) 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade io.vertx:vertx-core to a version beyond the affected ranges (such as 4.5.35+, 5.0.13+, 5.1.10+, or 5.2.1+). If patching immediately is not possible, disable WebSocket per-message deflation/compression extensions in your Vert.x server configuration.
$ ./mvnw dependency:tree -Dincludes=io.vertx:vertx-coreAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is io.vertx:vertx-core.