CVE-2026-102477: Maven/io.vertx/vertx-grpc-server vulnerability
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks.
The impacted component is io.vertx:vertx-gprc-server.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using the io.vertx:vertx-grpc-server component are affected when running versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, or 5.2.0.
What does an attacker need to do to trigger the issue?
An attacker needs to send a compressed gRPC message whose compressed size is within the configured per-message limit but whose uncompressed content is much larger. Processing it can force the endpoint to allocate more memory than the configured limit allows.
Does configuring a per-message maximum size prevent this issue?
No. The configured maximum is applied to received bytes, so for compressed messages it limits only the compressed size rather than the size of the uncompressed content.
How can I determine whether an application is exposed?
Check whether the application includes io.vertx:vertx-grpc-server and compare its resolved version with the affected version ranges. Endpoints that receive compressed gRPC messages are relevant to this issue.