Eclipse Vert.x (4.0.0-4.5.35, 5.0.0-5.2.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/eclipse-vert.x-4.0.0-4.5.35-5.0.0-5.2.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 18:02:21 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEclipse Vert.x: Denial of Service via vertx-stomp FrameParser (CVE-2026-118487)https://feed.craftedsignal.io/briefs/2026-11-eclipse-vertx-dos/Tue, 03 Nov 2026 18:02:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-eclipse-vertx-dos/The FrameParser component in vertx-stomp fails to limit record sizes, allowing an attacker to cause JVM heap exhaustion and process crashes via continuous byte streams.Eclipse Vert.x versions [4.0.0, 4.5.35] and [5.0.0, 5.2.2] contain a vulnerability in the FrameParser component of vertx-stomp. The parser creates a RecordParser without enforcing a maxRecordSize. Consequently, if a peer streams data continuously without a newline character, the parser accumulates this data in memory indefinitely. Both STOMP clients and servers are susceptible to this memory exhaustion attack, which results in a complete denial of service for the affected process.

Impact

Successful exploitation results in JVM heap memory exhaustion, leading to the crash of the affected STOMP client or server process.

Recommendation

  • Identify all applications utilizing vertx-stomp within the organization.
  • Upgrade affected Eclipse Vert.x deployments to versions addressing this vulnerability (check vendor advisories for specific patched releases beyond 4.5.35 and 5.2.2).
  • Implement monitoring for JVM memory usage patterns to detect anomalous heap growth associated with STOMP connections.
]]>lowadvisorydenial-of-servicememory-exhaustionjavavulnerability