CVE-2026-102467
Description
A flaw was found in Eclipse Vert.x. The WebSocket implementation does not limit memory allocation when decompressing incoming frames or messages. A remote attacker can exploit this vulnerability by sending a compressed payload designed to expand into an excessively large size (a decompression bomb), causing excessive memory consumption and leading to a Denial of Service (DoS).
Statement
A denial of service flaw was found in Eclipse Vert.x, where the WebSocket implementation in the io.vertx:vertx-core component does not define a maximum number of bytes to allocate when decompressing compressed WebSocket frames or messages. A remote, unauthenticated attacker can exploit this flaw by sending a maliciously compressed payload (a decompression or "zip" bomb) over a WebSocket connection; upon decompression the payload expands into an excessively large memory allocation, exhausting server memory and making the affected application unavailable. The flaw affects only availability and does not compromise confidentiality or integrity. Red Hat rates this flaw as IMPORTANT, consistent with the upstream severity assessment. The vulnerable code is in an upstream Java library, and no Red Hat product is currently recorded as affected; evaluation of potential Red Hat exposure is still in progress.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
