{"id":"CVE-2026-102475","revision":"54097b8861e54ddf987936e1e4b00548","records":[{"revision":"54097b8861e54ddf987936e1e4b00548","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-102475","aliases":[],"title":"In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to …","description":"In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer.\n\n\n\nThe impacted component is io.vertx:vertx-http-proxy.","state":0,"publishedAt":"2026-10-15T07:24:09.062+00:00","modifiedAt":"2026-10-15T14:35:42.319+00:00","affected":[{"ecosystem":"Vendor product","name":"Eclipse Vert.x","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Eclipse Foundation\",\n                    \"product\": \"Eclipse Vert.x\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.0.0\",\n                            \"lessThanOrEqual\": \"5.0.12\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.1.0\",\n                            \"lessThanOrEqual\": \"5.1.9\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.2.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/eclipse-vertx/vertx-http-proxy/security/advisories/GHSA-mjwh-5qfp-hjgc","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/351"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102475","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-102475","identifiers":["CVE-2026-102475"]},"retained":false,"historicalAffected":[]}],"coverage":[]}