Eclipse Vert.x: Denial of Service via vertx-stomp FrameParser (CVE-2026-118487)
The FrameParser component in vertx-stomp fails to limit record sizes, allowing an attacker to cause JVM heap exhaustion and process crashes via continuous byte streams.
CVE search metadata
CVE search record: CVE-2026-118487. Severity: high. CVSS: 7.5. KEV: no. Product: Eclipse Vert.x (4.0.0-4.5.35, 5.0.0-5.2.2). Brief: Eclipse Vert.x: Denial of Service via vertx-stomp FrameParser (CVE-2026-118487). Brief link: https://feed.craftedsignal.io/briefs/2026-11-eclipse-vertx-dos/
Triage facts
Revision 1- Applicability
- Eclipse Vert.x (4.0.0-4.5.35, 5.0.0-5.2.2)
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 18:02 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Eclipse Vert.x versions [4.0.0, 4.5.35] and [5.0.0, 5.2.2] contain a vulnerability in the FrameParser component of vertx-stomp. The parser creates a RecordParser without enforcing a maxRecordSize. Consequently, if a peer streams data continuously without a newline character, the parser accumulates this data in memory indefinitely. Both STOMP clients and servers are susceptible to this memory exhaustion attack, which results in a complete denial of service for the affected process.
Impact
Successful exploitation results in JVM heap memory exhaustion, leading to the crash of the affected STOMP client or server process.
Recommendation
- Identify all applications utilizing
vertx-stompwithin the organization. - Upgrade affected Eclipse Vert.x deployments to versions addressing this vulnerability (check vendor advisories for specific patched releases beyond 4.5.35 and 5.2.2).
- Implement monitoring for JVM memory usage patterns to detect anomalous heap growth associated with STOMP connections.
Immediate actions
Inventory applications using the vertx-stomp library to assess exposure.
Threat Hunt
Monitor JVM heap memory metrics for sustained, abnormal increases coinciding with STOMP traffic volume.
Data: JVM heap usage metrics (e.g., JMX, monitoring agents), STOMP connection logs
Mitigations
Upgrade Eclipse Vert.x to a version beyond 4.5.35 or 5.2.2 that contains the fix for CVE-2026-118487.
CVE-2026-118487