CVE-2026-102465
Undergoing Analysis Undergoing Analysis - In Progress

Vert.x Redis Client RESP Parser Memory Exhaustion

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Vert.x event loop thread, denying service to all connections and verticles sharing that loop. The impacted component is io.vertx:vertx-mysql-client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-102465
EUVD
EUVD-2026-101927

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Eclipse Foundation Eclipse Vert.x 4.0.0
Eclipse Foundation Eclipse Vert.x 5.0.0
Eclipse Foundation Eclipse Vert.x 5.1.0
Eclipse Foundation Eclipse Vert.x 5.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Eclipse Vert.x Redis client in specific versions. The RESP parser pre-allocates arrays based on the length declared by the Redis server without an upper bound. A malicious server or man-in-the-middle attacker can send a crafted response with an extremely large array length, causing the client to attempt massive heap allocation. This leads to an OutOfMemoryError, crashing the Vert.x event loop thread and denying service to all connections and verticles using that thread.

Detection Guidance

Check if your system uses vulnerable versions of Vert.x Redis client (4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, or 5.2.0). Inspect dependency files like pom.xml or build.gradle for io.vertx:vertx-redis-client. Monitor for OutOfMemoryError crashes in Vert.x event loop threads.

Impact Analysis

If exploited, this vulnerability can crash the Vert.x event loop thread, causing a denial of service. All applications or services relying on the affected Vert.x Redis client versions may become unavailable until the issue is patched or the service is restarted. This impacts availability of systems using these versions.

Compliance Impact

This vulnerability primarily impacts system availability by causing denial-of-service through OutOfMemoryError crashes. It does not directly affect data confidentiality or integrity but may indirectly impact compliance with standards like GDPR or HIPAA by disrupting service availability, potentially leading to unauthorized access or data processing interruptions if critical systems are affected.

Mitigation Strategies

Upgrade to patched versions: 4.5.35, 5.1.10, 5.2.1, or later. If upgrading is not possible, restrict network access to Redis servers or use trusted connections. Implement rate limiting and input validation for RESP responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102465. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart