CVE-2026-118488
Description
A flaw was found in the Eclipse Vert.x Redis client. A malicious server can cause a Denial of Service (DoS) by sending unbounded data or malformed Redis Serialization Protocol (RESP) responses. Due to missing input size limits and improper parsing of incomplete response terminators, the client can allocate memory without bounds or enter an infinite loop. This behavior exhausts system memory, leading to an Out-of-Memory (OOM) crash of the application.
Statement
This vulnerability is rated as Moderate severity because exploitation requires an application to receive crafted responses from an untrusted or compromised Redis endpoint, which necessitates significant adversary positioning or network-level manipulation. In standard Red Hat enterprise architectures, Redis deployments reside within protected, trusted internal network boundaries rather than facing arbitrary external traffic. Even when triggered, the consequence is isolated to application denial of service through memory exhaustion, with no compromise of data confidentiality or system integrity.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
