CVE Tools
Track your stack

Eclipse Vert.x

30 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Eclipse Vert.x, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Eclipse Vert.x CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Eclipse Vert.x CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-011
2026-020
2026-030
2026-040
2026-051
2026-060
2026-072
2026-080
2026-090
2026-1016
2026-113

Severity

How the 30 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical310%
  • High621%
  • Medium2069%

Latest CVEs

The 15 most recently published vulnerabilities affecting Eclipse Vert.x.

  1. CVE-2026-118487Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser7.5
  2. CVE-2026-118488Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client5.9
  3. CVE-2026-118489CachingWebClient shares user-specific HTTP responses across users via the shared cache tier7.5
  4. CVE-2026-102477In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size...5.9
  5. CVE-2026-102464In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received ...5.9
  6. CVE-2026-102461In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or ...5.9
  7. CVE-2026-103224In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory bu...5.9
  8. CVE-2026-103223In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protoc...5.9
  9. CVE-2026-102466In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on ...5.9
  10. CVE-2026-102463In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array...5.9
  11. CVE-2026-102469In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User...5.9
  12. CVE-2026-102462In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packe...5.9
  13. CVE-2026-102465In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without ...5.9
  14. CVE-2026-102475In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded bu...5.9
  15. CVE-2026-102467In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing...5.9

Product grouping is registry-driven, with AI assist and human review. How it works