Eclipse Foundation Eclipse Vert.x vulnerabilities

16 CVEs affecting Eclipse Foundation Eclipse Vert.x, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-103224, published 2026-10-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-102469, published 2026-10-15. Critical severity, CVSS 9.2. EPSS: 0.4% chance of exploitation in the next 30 days. In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User…
CVE-2026-102461, published 2026-10-15. High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days. In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or…
CVE-2026-102477, published 2026-10-15. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size…
CVE-2026-102471, published 2026-10-14. Medium severity, CVSS 6.9. EPSS: 0.3% chance of exploitation in the next 30 days. In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) characters in user-supplied email header…
CVE-2026-102460, published 2026-10-14. High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days. In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with…
CVE-2026-103224, published 2026-10-15. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory…
CVE-2026-103223, published 2026-10-15. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol…
CVE-2026-102462, published 2026-10-15. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets…
CVE-2026-102464, published 2026-10-15. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received…
CVE-2026-102463, published 2026-10-15. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array…

Latest

CVE-2026-102466, published 2026-10-15. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a…
CVE-2026-102475, published 2026-10-15. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded…