CVE-2026-102461: Eclipse Vert.x DOS Vulnerability

CVE-2026-102461 Overview

CVE-2026-102461 is a denial of service vulnerability in Eclipse Vert.x affecting the io.vertx:vertx-json-schema component. The uniqueItems keyword validator uses an O(n²) pairwise comparison loop without short-circuit logic or array size limits. A remote unauthenticated attacker can submit a moderately-sized JSON array that triggers disproportionate CPU consumption, leading to service unavailability. The flaw is tracked under [CWE-407: Inefficient Algorithmic Complexity]. Affected versions span [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and 5.2.0. Modules depending on vertx-json-schema inherit the risk, including vertx-web-openapi-router, vertx-web-validation, and vertx-openapi.

Critical Impact
Unauthenticated remote attackers can exhaust CPU resources on Vert.x services that validate JSON input against schemas containing the uniqueItems keyword.

Affected Products

Eclipse Vert.x versions 4.0.0 through 4.5.34
Eclipse Vert.x versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0
Dependent modules: io.vertx:vertx-web-openapi-router, io.vertx:vertx-web-validation, io.vertx:vertx-openapi

Discovery Timeline

2026-10-15 - CVE-2026-102461 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-102461

Vulnerability Analysis

The vulnerability resides in the JSON Schema validator component of Eclipse Vert.x. When a schema declares uniqueItems: true, the validator must verify that every element in an input array is distinct. The implementation compares each pair of elements using nested iteration, producing quadratic time complexity relative to array length.

The loop lacks two defensive controls. First, it does not short-circuit when a duplicate is found early. Second, it enforces no upper bound on the array size subjected to comparison. Submitting an array of a few thousand elements can drive CPU utilization to saturation on a single request handler.

Services built on vertx-web-openapi-router, vertx-web-validation, or vertx-openapi inherit the vulnerable code path whenever they validate request bodies against OpenAPI or JSON Schema definitions that include uniqueItems constraints.

Root Cause

The root cause is an inefficient algorithm classified under [CWE-407]. The pairwise element comparison runs in O(n²) time, and the absence of input size validation allows attackers to amplify the cost of a single HTTP request. Deep or complex array elements further increase per-comparison cost because equality checks recurse through nested structures.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker identifies an HTTP endpoint whose schema uses uniqueItems on an array field. The attacker then submits a crafted JSON payload containing an array sized to maximize validator CPU time. Repeated requests exhaust worker threads and block legitimate traffic.

No exploitation code or verified public proof-of-concept is available at the time of publication. Refer to the GitHub Security Advisory GHSA-4m87-8qfr-8p8m for maintainer-provided technical context.

Detection Methods for CVE-2026-102461

Indicators of Compromise

Sustained CPU saturation on Vert.x event loop or worker threads correlated with inbound HTTP requests carrying large JSON arrays
Request latency spikes or thread blockage on endpoints that validate payloads against schemas containing uniqueItems
Repeated requests from a single source submitting arrays with unusually high element counts to API routes

Detection Strategies

Inspect application logs for prolonged validation durations on routes handled by vertx-web-openapi-router or vertx-web-validation
Audit OpenAPI and JSON Schema definitions to enumerate endpoints that apply uniqueItems constraints to array fields
Correlate web application firewall telemetry with backend CPU metrics to identify anomalous payload sizes

Monitoring Recommendations

Instrument validation handlers with per-request duration metrics and alert when execution time exceeds expected thresholds
Track payload size distributions at the ingress tier and flag outliers targeting JSON array fields
Monitor Vert.x worker pool utilization and event-loop blocked-thread warnings

How to Mitigate CVE-2026-102461

Immediate Actions Required

Upgrade io.vertx:vertx-json-schema and dependent Vert.x modules to patched releases above the affected version ranges
Enforce request body size limits at the HTTP server, reverse proxy, or API gateway layer
Add schema-level maxItems constraints to any array field that uses uniqueItems
Deploy rate limiting on endpoints that accept arrays validated with uniqueItems

Patch Information

Eclipse published the fix through the GitHub Security Advisory GHSA-4m87-8qfr-8p8m. Coordination details are tracked in the Eclipse GitLab CVE Assignment Work Item 340. Upgrade all transitive dependencies that pull vertx-json-schema, including vertx-web-openapi-router, vertx-web-validation, and vertx-openapi.

Workarounds

Remove or disable uniqueItems keywords from schemas on externally reachable endpoints until patches are applied
Introduce a pre-validation filter that rejects arrays exceeding a defined element count before schema validation runs
Terminate TLS at a gateway that enforces strict payload size and request rate limits for Vert.x backends

bash

# Configuration example: enforce maxItems alongside uniqueItems in schema
# schema.json fragment
{
  "type": "array",
  "uniqueItems": true,
  "maxItems": 100,
  "items": { "type": "string" }
}