CVE-2026-102467: Maven/io.vertx/vertx-core vulnerability

Q: Which deployments are exposed to this denial-of-service issue?

Applications using io.vertx:vertx-core in the affected version ranges are exposed where they accept WebSocket frames or messages that can be decompressed. The issue affects the WebSocket implementation.

Q: What does an attacker need to exploit the issue?

An attacker needs to send a compressed WebSocket frame or message crafted as a zip bomb. Decompression can then trigger unbounded byte allocation and support a denial-of-service attack.

Q: Which versions should be prioritized for remediation?

Prioritize Vert.x versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0. The provided data does not identify fixed versions.

Published Oct 15, 2026

Updated

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb.

The impacted component is io.vertx:vertx-core.

Affected Software

1 affected component

maven/io.vertx/vertx-core>=4.0.0<=4.5.34, >=5.0.0<=5.0.12, >=5.1.0<=5.1.9, =5.2.0

Event History

Oct 15, 2026

CVE Published

via MITRE·07:19 AM

Data Sourced

via MITRE·07:19 AM

Description

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Applications using io.vertx:vertx-core in the affected version ranges are exposed where they accept WebSocket frames or messages that can be decompressed. The issue affects the WebSocket implementation.

What does an attacker need to exploit the issue?

An attacker needs to send a compressed WebSocket frame or message crafted as a zip bomb. Decompression can then trigger unbounded byte allocation and support a denial-of-service attack.

Which versions should be prioritized for remediation?

Prioritize Vert.x versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0. The provided data does not identify fixed versions.