GHSA-cchp-hff9-j7q7: Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser
In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the FrameParser in vertx-stomp creates a RecordParser without setting maxRecordSize, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Both Vert.x STOMP servers and clients are affected. A server can be attacked by a malicious client, while a client can be attacked by a malicious STOMP server it connects to.
Does exploiting this require authentication or user interaction?
No. The supplied vector indicates network access, low attack complexity, no privileges, and no user interaction. A malicious client can attack a server before or after authentication.
What does an attacker need to send?
The attacker must sustain a stream of bytes without a newline character. This causes the parser to retain data without a configured record-size limit until JVM heap memory is exhausted.
What is the operational impact?
Heap exhaustion crashes the affected JVM process, resulting in a complete denial of service. The provided data does not indicate confidentiality or integrity impact.