CVE-2026-102475: Maven/io.vertx/vertx-http-proxy vulnerability
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer.
The impacted component is io.vertx:vertx-http-proxy.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the io.vertx:vertx-http-proxy component are affected only when they use an intercepting body transformer. The issue applies to Eclipse Vert.x versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0.
What does an attacker need to exploit this issue?
An attacker needs to be able to send requests through an HTTP proxy configured with an intercepting body transformer. The transformer’s max buffered-bytes limit can then be abused to cause the server to continue allocating heap indefinitely.
How can I determine whether my application is affected?
Check whether io.vertx:vertx-http-proxy is present and whether its version falls in an affected range. Then review proxy configuration and code for use of an intercepting body transformer; deployments without one do not meet the stated vulnerability requirement.