Heap Allocation Vulnerability in Vert.x Redis Client by Eclipse

CVE-2026-102465

What is CVE-2026-102465?

The Redis client in specific versions of Eclipse Vert.x is vulnerable due to its RESP parser, which pre-allocates arrays based on server declarations without enforcing a maximum limit. This flaw permits a malicious Redis server—or an attacker positioned as a man-in-the-middle—to craft a RESP response that demands an excessively large array, causing the client to make an enormous heap allocation. This can lead to an OutOfMemoryError, crashing the Vert.x event loop thread and resulting in denial of service for all connections and verticles utilizing that loop.

References