Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-102475 Overview
CVE-2026-102475 is a resource exhaustion vulnerability in the Eclipse Vert.x HTTP proxy component io.vertx:vertx-http-proxy. The flaw affects the body transformer interceptor, which relies on a configurable maximum buffered bytes limit to bound per-request memory consumption. Attackers can bypass this limit and force the server to allocate heap memory indefinitely, leading to a denial-of-service condition. The vulnerability only applies when an application uses an intercepting body transformer.
Affected versions include Eclipse Vert.x [5.0.0, 5.0.12], [5.1.0, 5.1.9], and 5.2.0. The weakness is classified under [CWE-770: Allocation of Resources Without Limits or Throttling].
Critical Impact
Remote unauthenticated attackers can exhaust Java Virtual Machine heap memory on proxy servers using an intercepting body transformer, causing service disruption.
Affected Products
- Eclipse Vert.x 5.0.0 through 5.0.12
- Eclipse Vert.x 5.1.0 through 5.1.9
- Eclipse Vert.x 5.2.0
Discovery Timeline
- 2026-10-15 - CVE-2026-102475 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-102475
Vulnerability Analysis
The Eclipse Vert.x HTTP proxy includes a body transformer interceptor used to inspect or modify HTTP message bodies as they traverse the proxy. To prevent unbounded memory growth, the interceptor accepts a maximum buffered bytes limit intended to cap the size of in-memory data retained per request.
The implementation does not reliably enforce this limit under all code paths. An attacker transmitting a crafted request can cause the proxy to continuously accumulate body data in the heap beyond the declared threshold. Repeated or concurrent requests amplify the condition and drive the Java Virtual Machine toward an OutOfMemoryError, degrading or terminating the proxy process.
The vulnerability requires no authentication and is reachable over the network wherever the vulnerable proxy accepts client traffic. Only deployments that register an intercepting body transformer are affected.
Root Cause
The root cause is improper enforcement of the max buffered bytes limit within the body transformer interceptor. The buffering logic fails to terminate accumulation when the configured threshold is exceeded. This produces an unbounded resource allocation primitive aligned with [CWE-770].
Attack Vector
Exploitation requires the attacker to send HTTP requests that flow through the vulnerable proxy and are processed by the intercepting body transformer. Because the interceptor buffers request bodies, an adversary can submit large or deliberately shaped payloads to force sustained heap allocation until memory is exhausted. For technical specifics, see the GitHub Security Advisory GHSA-mjwh-5qfp-hjgc.
Detection Methods for CVE-2026-102475
Indicators of Compromise
- Sustained growth of Java Virtual Machine heap usage on hosts running vertx-http-proxy without a corresponding increase in legitimate request volume.
- OutOfMemoryError entries or garbage-collection thrashing in Vert.x proxy application logs.
- Spikes in request body size or request duration associated with endpoints routed through the body transformer interceptor.
Detection Strategies
- Inventory Java applications that depend on io.vertx:vertx-http-proxy versions in the affected ranges and verify whether an intercepting body transformer is registered.
- Correlate application performance monitoring (APM) heap metrics with HTTP access logs to identify request patterns that precede memory exhaustion events.
- Deploy Web Application Firewall (WAF) or reverse proxy rules to flag abnormally large or slow-streamed request bodies toward Vert.x endpoints.
Monitoring Recommendations
- Alert on JVM heap utilization crossing sustained high-water marks on Vert.x proxy hosts.
- Track process restarts and crash signatures referencing java.lang.OutOfMemoryError: Java heap space on affected services.
- Monitor outbound 5xx responses and connection resets originating from the proxy tier that may indicate exhaustion in progress.
How to Mitigate CVE-2026-102475
Immediate Actions Required
- Upgrade io.vertx:vertx-http-proxy to a fixed version as published in the vendor advisory.
- Audit all Vert.x applications for use of body transformer interceptors and prioritize patching those deployments.
- Place rate limits and request body size caps at an upstream reverse proxy or WAF to reduce exposure until patching completes.
Patch Information
Eclipse has published remediation guidance in the GitHub Security Advisory GHSA-mjwh-5qfp-hjgc and the corresponding Eclipse GitLab CVE assignment. Upgrade beyond the affected ranges [5.0.0, 5.0.12], [5.1.0, 5.1.9], and 5.2.0.
Workarounds
- Remove or disable the intercepting body transformer in HTTP proxy configurations where it is not strictly required.
- Enforce strict request body size limits at a fronting load balancer, reverse proxy, or WAF to cap buffered memory per connection.
- Apply per-client connection and request-rate limits to constrain concurrent memory allocation by any single source.
# Example Maven dependency update - replace with the fixed version from the vendor advisory
# <dependency>
# <groupId>io.vertx</groupId>
# <artifactId>vertx-http-proxy</artifactId>
# <version>FIXED_VERSION</version>
# </dependency>
mvn versions:use-latest-versions -Dincludes=io.vertx:vertx-http-proxy
mvn dependency:tree | grep vertx-http-proxy
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
