Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-102467 Overview
CVE-2026-102467 affects Eclipse Vert.x, a toolkit for building reactive applications on the Java Virtual Machine. The WebSocket implementation in io.vertx:vertx-core fails to enforce a maximum byte allocation when decompressing incoming frames or messages. Attackers can exploit this behavior by sending compressed WebSocket payloads that expand to very large sizes, consuming memory until the service degrades or crashes. The flaw is categorized under [CWE-770]: Allocation of Resources Without Limits or Throttling. Affected ranges span [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and 5.2.0.
Critical Impact
Unauthenticated remote attackers can trigger memory exhaustion through zip-bomb WebSocket frames, enabling denial-of-service against any Vert.x service accepting compressed WebSocket traffic.
Affected Products
- Eclipse Vert.x vertx-core versions 4.0.0 through 4.5.34
- Eclipse Vert.x vertx-core versions 5.0.0 through 5.0.12
- Eclipse Vert.x vertx-core versions 5.1.0 through 5.1.9, and 5.2.0
Discovery Timeline
- 2026-10-15 - CVE-2026-102467 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-102467
Vulnerability Analysis
The vulnerability resides in the WebSocket frame and message decompression path within io.vertx:vertx-core. Vert.x negotiates the permessage-deflate extension during the WebSocket handshake and transparently inflates compressed payloads for application handlers. The decompression routine does not define an upper bound on the number of bytes allocated during inflation. A small compressed payload can expand to orders of magnitude more decompressed bytes, a pattern commonly referred to as a zip bomb.
Because Vert.x runs on an event loop with shared heap memory, uncontrolled allocation from a single connection can starve other handlers. Repeated or concurrent abusive connections amplify the effect, producing sustained denial of service against the Java Virtual Machine process.
Root Cause
The root cause is the absence of a configurable maximum size for decompressed WebSocket frames and messages. The decoder streams inflated bytes into memory buffers without checking the cumulative output length against a configured ceiling. This design assumes trusted or well-formed peers and does not account for maliciously crafted compressed payloads.
Attack Vector
An attacker initiates a WebSocket connection to a vulnerable Vert.x endpoint and negotiates permessage-deflate. The attacker then transmits a highly compressible payload, such as a long run of repeated bytes compressed to a few kilobytes that inflate to hundreds of megabytes or more. No authentication is required when the WebSocket endpoint is publicly reachable. The attack vector is network-based, requires low complexity, and does not need user interaction.
No public proof-of-concept or active exploitation has been reported for CVE-2026-102467. Technical details are available in the Eclipse Vert.x GitHub Security Advisory.
Detection Methods for CVE-2026-102467
Indicators of Compromise
- Sudden JVM heap growth or OutOfMemoryError events on hosts running Vert.x WebSocket services
- WebSocket connections negotiating permessage-deflate followed by small inbound frames that correlate with large memory spikes
- Repeated connection attempts from the same source IP addresses to WebSocket endpoints prior to service degradation
Detection Strategies
- Monitor Vert.x process memory, garbage collection pause times, and event-loop blocked warnings for anomalies tied to WebSocket traffic
- Inspect reverse proxy and load balancer logs for WebSocket upgrade requests with Sec-WebSocket-Extensions: permessage-deflate followed by abnormal connection duration or termination codes
- Correlate application-layer DoS symptoms with inbound compressed WebSocket frame sizes using network telemetry
Monitoring Recommendations
- Enable JVM metrics export (heap usage, GC counts, thread states) to a centralized observability pipeline
- Alert on sustained heap usage above baseline thresholds on Vert.x service nodes
- Capture WebSocket handshake metadata at the ingress tier to identify which clients negotiate compression extensions
How to Mitigate CVE-2026-102467
Immediate Actions Required
- Inventory applications and services depending on io.vertx:vertx-core and identify versions in the affected ranges
- Upgrade io.vertx:vertx-core to a fixed release as published in the Eclipse Vert.x Security Advisory GHSA-h722-h6c2-6j3c
- Restrict exposure of WebSocket endpoints to trusted networks where upgrade cannot be performed immediately
- Apply rate limiting and per-connection memory limits at the ingress layer
Patch Information
Eclipse has published fixes referenced in GHSA-h722-h6c2-6j3c and tracked in the Eclipse GitLab CVE Assignment work item. Upgrade past the affected ranges: 4.5.34, 5.0.12, 5.1.9, and 5.2.0. Review the advisory for the specific fixed version applicable to your release branch.
Workarounds
- Disable WebSocket compression negotiation on vulnerable endpoints by rejecting the permessage-deflate extension at the server or proxy
- Terminate WebSocket traffic at a hardened reverse proxy that enforces maximum decompressed frame sizes
- Enforce strict connection and message rate limits per source IP to reduce zip-bomb amplification
# Configuration example - update Maven dependency to a fixed release
# Replace <fixed-version> with the patched version from the Eclipse advisory
# <dependency>
# <groupId>io.vertx</groupId>
# <artifactId>vertx-core</artifactId>
# <version><fixed-version></version>
# </dependency>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
