Eclipse Vert.x EUVD-2026-101933

Exploitation requires the target application to perform JSON schema validation using Eclipse Vert.x's io.vertx:vertx-json-schema (directly, or transitively via vertx-web-openapi-router, vertx-web-validation, or vertx-openapi) on attacker-controllable input, AND the active schema must employ the uniqueItems keyword against an array field. When those conditions hold, no further prerequisites apply (AV:N/AC:L/AT:N/PR:N/UI:N): a remote unauthenticated attacker simply sends one moderately-sized JSON array to the validated endpoint. Limiting factors: applications that do not use uniqueItems in their schemas, that do not expose schema-validated endpoints to untrusted clients, or that enforce request/array size limits upstream (e.g., at a gateway or body-size filter) are not practically exploitable. Affected versions are [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and 5.2.0.

This is a genuine denial-of-service vulnerability whose CVSS 4.0 score of 8.7 (HIGH) is driven entirely by availability impact (VA:H) with no confidentiality or integrity consequence (VC:N/VI:N). The attack vector is favorable to an attacker: network-reachable (AV:N), low complexity (AC:L), no attack requirements (AT:N), no privileges (PR:N), and no user interaction (UI:N) - meaning a remote unauthenticated attacker can trigger it against default validation behavior. However, several escalation signals are ABSENT: there is no EPSS score provided, no CISA KEV listing, and no public exploit code referenced, so there is no evidence of active or widespread exploitation at this time. The real-world severity is also tempered by the impact ceiling - this is pure CPU exhaustion (algorithmic complexity DoS), not code execution or data compromise, and exploitation requires the application to actually expose a JSON-schema-validated endpoint using the uniqueItems keyword. Net: a real and easily reproducible availability risk for affected deployments that validate untrusted JSON arrays, but not a 'drop everything' critical in the way an RCE would be. Note the high CVSS reflects the ease of triggering a service outage, not breadth of impact; prioritize for internet-facing API gateways using vertx-openapi/vertx-web-validation.

An attacker identifies a public API endpoint built on Vert.x that validates request bodies against a JSON schema containing a uniqueItems constraint. They submit a single moderately-sized JSON array in the request body, which forces the validator into an O(n²) pairwise comparison with no short-circuit or size limit, pinning a CPU core and degrading or halting the service. No authentication, special privileges, or user interaction is required (AV:N/AC:L/PR:N/UI:N); no public exploit code was identified at time of analysis, but the technique is trivial to reproduce from the advisory description.