Live › vulnerability › CVE-2026-118487
The vertx-stomp FrameParser builds a RecordParser with no maxRecordSize, so it buffers bytes without a newline indefinitely. A connected peer can stream data to exhaust JVM heap and crash the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Applications that embed io.vertx:vertx-stomp (<= 4.5.35, or 5.0.0 to 5.2.2) to run a STOMP server or act as a STOMP client. A malicious peer can stream bytes without a newline to exhaust JVM heap, against a server (before or after authentication) or against a connecting client. Services without the STOMP module, or on 4.5.36 / 5.2.3 or later, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| io.vertx:vertx-stomp | maven | <= 4.5.35; >= 5.0.0, <= 5.2.2 | 4.5.36, 5.2.3 |
4.5.36 (4.x line) or 5.2.3 (5.x line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the FrameParser in vertx-stomp creates a RecordParser without setting maxRecordSize, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-118487")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.