CVE-2026-102477

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102477
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102477.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102477
Aliases
  • GHSA-4wvq-75mw-q6cg
Published
2026-10-15T08:28:25Z
Modified
2026-10-17T02:47:30Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
[none]
Details

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks.

The impacted component is io.vertx:vertx-gprc-server.

Database specific 
{
    "cna_assigner":  "eclipse",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102477.json"
}
References

Affected packages

Git / github.com/eclipse-vertx/vertx-grpc

Affected ranges

Type
GIT
Repo
https://github.com/eclipse-vertx/vertx-grpc
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
d3ba8a52ba53b31640e9074e8dc66c7950bdb6d6
Introduced
462f9aa5b2e42ed0e5aced1f1ebc99138a129268
Last Affected
1a15e63ed1e0616714bec0312a32c1d935762bb0
Introduced
83d529e51c7972b5649601c4a86e468da59724e1
Last Affected
688605648a048fd08017e178f1c4478d0f938882
Introduced
23abaa946e0533ae327400852c754ed2cfec2e06
Last Affected
23abaa946e0533ae327400852c754ed2cfec2e06
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "last_affected":  "4.5.34"
        },
        {
            "introduced":  "5.0.0"
        },
        {
            "last_affected":  "5.0.12"
        },
        {
            "introduced":  "5.1.0"
        },
        {
            "last_affected":  "5.1.9"
        },
        {
            "introduced":  "5.2.0"
        },
        {
            "last_affected":  "5.2.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

4.*
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.5.0
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.15
4.5.16
4.5.17
4.5.18
4.5.19
4.5.2
4.5.20
4.5.21
4.5.22
4.5.23
4.5.24
4.5.25
4.5.26
4.5.27
4.5.28
4.5.29
4.5.3
4.5.30
4.5.31
4.5.32
4.5.33
4.5.34
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
5.*
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102477.json"