CVE-2026-102461
Received Received - Intake

Denial of Service in Eclipse Vert.x JSON Schema Validation

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time, leading to denial of service. The impacted component is io.vertx:vertx-json-schema. The following Vert.x modules depend on vertx-json-schema and are also affected: io.vertx:vertx-web-openapi-router io.vertx:vertx-web-validation io.vertx:vertx-openapi

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-102461
EUVD
EUVD-2026-101933

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Eclipse Foundation Eclipse Vert.x 4.0.0
Eclipse Foundation Eclipse Vert.x 5.0.0
Eclipse Foundation Eclipse Vert.x 5.1.0
Eclipse Foundation Eclipse Vert.x 5.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in Eclipse Vert.x versions within specific ranges. It involves the JSON Schema uniqueItems validation using an inefficient O(n²) pairwise comparison loop without short-circuiting or size limits. A remote unauthenticated attacker can exploit this by sending a moderately-sized JSON array, consuming excessive CPU resources and causing system unavailability.

Detection Guidance

Check if your system runs affected Vert.x versions by inspecting dependency files or running commands like 'vertx version' or 'find / -name vertx-json-schema*.jar 2>/dev/null'. Monitor CPU usage spikes during JSON validation requests. Enable verbose logging in Vert.x to detect unusual processing times for uniqueItems validation.

Impact Analysis

The vulnerability can lead to denial-of-service conditions where affected systems become unresponsive or slow due to high CPU usage. This impacts availability of services relying on Vert.x modules like vertx-json-schema, vertx-openapi, vertx-web-openapi-router, and vertx-web-validation.

Compliance Impact

This vulnerability primarily impacts system availability by causing denial-of-service through excessive CPU consumption. It does not directly affect confidentiality or integrity of data, which are key concerns for GDPR and HIPAA. However, prolonged unavailability of systems could lead to non-compliance with availability requirements in these regulations.

Mitigation Strategies

Upgrade to patched versions: 5.2.1, 5.1.10, 5.1.9, or 4.5.35. If upgrading is not possible, disable JSON Schema validation for uniqueItems or restrict network access to Vert.x services. Apply rate limiting to JSON input processing endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102461. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart