Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-10-15T07:24:09 io.vertx/vertx-http-proxy: vertx-http-proxy: Denial of Service via unbounded memory allocation in body transformer 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerability requires to use an intercepting body transformer. The impacted component is io.vertx:vertx-http-proxy.

A flaw was found in Eclipse Vert.x HTTP proxy. A remote attacker can cause a Denial of Service (DoS) by triggering unbounded memory allocation on the server. When the proxy is configured with an intercepting body transformer, buffer limits are not properly enforced, allowing requests to continuously allocate memory on the heap. This excessive memory consumption can exhaust system resources and cause the application to crash or become unresponsive.

This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exhaust server memory resources, leading to a complete denial of service across the hosting application. In Red Hat environments utilizing Vert.x-based runtimes, exploitation is contingent on services explicitly configuring HTTP proxy instances with intercepting body transformers. Standard deployments that do not register body transformation interceptors are not susceptible to this unbounded memory allocation defect. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Exploit Intelligence Affected exploit-intelligence/agent-client-rhel9 Red Hat build of Apache Camel 4 for Quarkus 3 Not affected vertx-http-proxy Red Hat build of Quarkus Not affected vertx-http-proxy https://www.cve.org/CVERecord?id=CVE-2026-102475 https://nvd.nist.gov/vuln/detail/CVE-2026-102475 https://github.com/eclipse-vertx/vertx-http-proxy/security/advisories/GHSA-mjwh-5qfp-hjgc https://gitlab.eclipse.org/security/cve-assignment/-/work_items/351