CVE-2026-102475: Eclipse Foundation Eclipse Vert.x

High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days.

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer. The impacted component is io.vertx:vertx-http-proxy.

Affected products

• Eclipse Foundation Eclipse Vert.x: from 5.0.0, up to and including 5.0.12; from 5.1.0, up to and including 5.1.9; version 5.2.0 only

Published 2026-10-15. Last modified 2026-10-15.