CVE-2026-102477
Description
A flaw was found in Eclipse Vert.x vertx-grpc-server. The server's configured maximum message size limit is enforced only on the received compressed data rather than on the uncompressed payload. A remote attacker can exploit this flaw by sending a specially crafted compressed message, causing excessive memory allocation upon decompression and resulting in a Denial of Service (DoS).
Statement
This IMPORTANT-severity flaw affects the Eclipse Vert.x gRPC server component (io.vertx:vertx-grpc-server). The component's configurable per-message maximum size limit is enforced only on the received compressed bytes rather than on the uncompressed payload, so a remote, unauthenticated attacker can send a specially crafted compressed gRPC message (a compression bomb) that forces the endpoint to allocate more memory than the configured limit permits, causing excessive memory allocation and a denial of service of the affected gRPC service. Only availability is impacted; confidentiality and integrity are not affected. Red Hat rates this flaw as IMPORTANT with a CVSS:3.1 base score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), matching the CVSS:3.1 score published in the upstream Eclipse Vert.x advisory; the CVEORG CVSS:4.0 score of 8.7 is higher due to the different CVSS version methodology. This flaw is in an upstream Maven component, and no Red Hat products are currently listed as affected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | 5.9 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | High | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
