Eclipse Vert.x gRPC: Compressed Messages Bypass Size Limits, Risk Memory Exhaustion

Eclipse Vert.x gRPC server components contain a configuration flaw that permits compression bomb attacks. The issue, tracked as CVE-2026-102477, affects how the server handles message size limits. According to the National Vulnerability Database, the flaw exists in multiple version branches of the io.vertx:vertx-gprc-server library.

Security teams managing these endpoints should verify their current versions immediately. The vulnerability allows an attacker to send a small compressed payload that expands into a large uncompressed message. This bypasses the intended safety controls designed to limit memory allocation. The National Vulnerability Database rates the severity of this issue as 8.7, which is classified as high.

Root cause

The vulnerability stems from how the server applies size limits to incoming gRPC messages. The configuration sets a maximum size in bytes for received data. However, this limit applies only to the compressed size of the message. It does not account for the actual size of the content after decompression. As a result, a small compressed file can expand significantly once processed. This forces the endpoint to allocate more memory than the configured maximum allows. The discrepancy between compressed and uncompressed sizes creates the attack surface.

Attack path

An attacker sends a gRPC request containing a highly compressed message. The message size stays within the configured per-message maximum limit. The server accepts the request because the compressed size is valid. Upon processing, the server decompresses the data. The uncompressed content exceeds the memory limits intended by the configuration. This can lead to excessive memory allocation on the server. The endpoint becomes vulnerable to resource exhaustion through this mechanism.

Affected versions

The following versions of Eclipse Vert.x are affected:

• Versions 4.0.0 through 4.5.34
• Versions 5.0.0 through 5.0.12
• Versions 5.1.0 through 5.1.9
• Version 5.2.0

Mitigation

• Verify if your deployment uses any of the affected version ranges.
• Monitor memory usage on gRPC endpoints for unusual spikes.
• Consider restricting gRPC access to trusted networks if possible.
• Wait for official patches from the Eclipse Foundation.

Signals worth monitoring

Teams usually detect compression bomb attempts by observing sudden memory consumption spikes on application servers. Check whether gRPC endpoints show increased CPU usage during decompression tasks. Look for alerts indicating out-of-memory errors or process crashes following small incoming requests. Verify that logging captures the size of incoming compressed payloads. Monitor for repeated connection attempts from single sources sending compressed data. Ensure that resource exhaustion alerts are configured for critical services. Review network traffic patterns for anomalies in message sizes. Containment moves typically involve rate limiting or blocking suspicious source IPs.

What to do and how to stay safe: Eclipse Vert.x

• Audit your environment to identify any running instances of the affected Vert.x versions.
• Implement network-level rate limiting on gRPC endpoints to reduce the impact of large payloads.
• Monitor server memory usage closely for signs of rapid allocation following incoming requests.
• Prepare to apply updates once the vendor releases a confirmed fix for this vulnerability.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific component is vulnerable to CVE-2026-102477?

The io.vertx:vertx-gprc-server component in Eclipse Vert.x is vulnerable.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-102477 with a CVSS score of 8.7.

Is there a patch available for this issue?

No fix has been confirmed yet in the provided source material.