TI-2026-84341 Aliases CVE-2026-118488 GHSA-8x59-c7x3-46jj

Unbounded memory allocation in Eclipse Vert.x Redis client

MEDIUM 60CWE-770Published 2026-11-03 · Updated 2026-11-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Eclipse Vert.x versions 4.0.0 through 4.5.35 and 5.0.0 through 5.2.2 contain a resource allocation flaw in their Redis client (CWE-770). A malicious server can keep sending bytes on a line terminated by end-of-line rather than a length prefix, so the client buffers without any limit. A crafted bulk string with a missing CRLF trailer also makes the parser loop and push the same response repeatedly. An attacker who controls the Redis server can exhaust heap memory and cause an out-of-memory error.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an EOL-terminated line (not length-prefixed, for example a simple string [1]), we'll keep growing the buffer without bounds, eventually leading to an OOM. We need to have a configurable limit for EOL-terminated lines. If a malicious server sends a specially crafted RESP response (for example a bulk string [2] with missing CRLF trailer), the parser enters an infinite loop where it keeps parsing the same buffer and pushing the same response to the caller, which may lead e.g. to an OOM if the consumer just buffers the responses. We must fix the parser to avoid this infinite looping.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00433 37th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Eclipse Foundation	Eclipse Vert.x	4.0.0 – 4.5.35; 5.0.0 – 5.2.2	—	No fix listed	CNA

Eclipse Vert.x VendorEclipse Foundation Affected 4.0.0 – 4.5.35; 5.0.0 – 5.2.2 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:eclipse:vert.x::::::::	—	—	Eclipse Foundation

cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* Versions — — ·Eclipse Foundation

Remediation

The sources list no fixed version for Eclipse Vert.x.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-11-03 Threatist record created from CVE-2026-118488
2026-11-03 Alias added: GHSA-8x59-c7x3-46jj
2026-11-03 Weakness changed · CISA ADP
2026-11-03 CISA SSVC decision points changed
2026-11-06 Affected versions changed · Red Hat
2026-11-06 CVSS score added · Red Hat

References

Other 2

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3

See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences