Compression Flaw in Eclipse Vert.x gRPC Server Affects Multiple Versions

CVE-2026-102477

What is CVE-2026-102477?

In various versions of Eclipse Vert.x, a flaw in the gRPC server's handling of message sizes allows an attacker to exploit the configuration for maximum message size. While the configuration limits the size of received bytes, this limitation only applies to the compressed size of incoming messages. Consequently, an attacker can craft a compressed message that, once uncompressed, exceeds the configured limit. This could potentially lead to a denial-of-service condition as the endpoint might allocate excessive resources to handle the uncompressed data, making systems vulnerable to compression bomb attacks. For detailed security advisories, please refer to the Eclipse security notifications.

References