Eclipse Vert.x CVE-2026-102475

Exploitation requires that the target application use Vert.x's HTTP proxy (io.vertx:vertx-http-proxy) AND explicitly configure an intercepting body transformer - the advisory states the vulnerability 'requires to use an intercepting body transformer.' The flaw lies in the body transformer interceptor's reliance on a max-buffered-bytes limit that fails to keep the per-request buffer bounded, allowing indefinite heap allocation. LIMITING FACTORS: this is a non-default deployment mode (body transformation is a developer-enabled feature, not on by default), which substantially narrows the exposed population; affected versions are restricted to 5.0.0-5.0.12, 5.1.0-5.1.9, and 5.2.0. Where the body transformer is NOT used, the service is not exploitable. No authentication is required (PR:N) once the vulnerable configuration is present.

This is a denial-of-service vulnerability in Eclipse Vert.x's vertx-http-proxy component (CVE-2026-102475), rated CVSS 8.7 under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H). The vector cleanly indicates a remote, unauthenticated, low-complexity attack with availability-only impact (VA:H) and no confidentiality or integrity impact (VC:N/VI:N). No EPSS score, KEV listing, or POC was provided; exploitation status is therefore 'no public exploit identified at time of analysis.' The key factor that lowers real-world risk below what the 8.7 score suggests is the exploitation precondition: the vulnerability only manifests when the application is deployed with an intercepting body transformer configured on the proxy. This is a non-default, developer-opt-in feature, so the exposed population is a subset of vertx-http-proxy deployments rather than all Vert.x users. The signals are consistent (network DoS, no auth) but the config dependency makes this a conditional priority - high impact where the feature is used, limited exposure elsewhere. CONFLICT TO NOTE: the input Tags label this 'Information Disclosure,' which contradicts the CVSS vector (VC:N, VA:H) - this is an availability/resource-exhaustion flaw, not information disclosure; the tag appears mislabeled.

An attacker sends HTTP requests through a Vert.x HTTP proxy that is configured with a body transformer interceptor, crafting request bodies that bypass or exceed the intended max-buffered-bytes limit so the server buffers unbounded data in the heap. Repeated or large requests force the proxy to indefinitely allocate heap memory until the JVM exhausts memory and the service crashes or becomes unresponsive. No public exploit code was identified at the time of analysis, and no authentication is required per the CVSS vector (PR:N).