{"id":"CVE-2026-118487","kind":"vulnerability","aliases":["CVE-2026-118487"],"related":[],"title":"Eclipse Vert.x STOMP: unbounded frame buffering lets a peer exhaust memory","description":"In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.","summary":"The vertx-stomp FrameParser builds a RecordParser with no maxRecordSize, so it buffers bytes without a newline indefinitely. A connected peer can stream data to exhaust JVM heap and crash the process.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"io.vertx:vertx-stomp","fixed":["4.5.36","5.2.3"],"affected":"<= 4.5.35; >= 5.0.0, <= 5.2.2","ecosystem":"maven"}],"ecosystems":[],"tags":["java","jvm","package","stomp","vert.x"],"not_affected_if":["no-stomp-module","vert.x-outside-affected-ranges"],"how_to_check":"- Run mvn dependency:tree or gradle dependencies and look for io.vertx:vertx-stomp (or the Vert.x BOM version): affected if <= 4.5.35 or 5.0.0 to 5.2.2.\n- Only services that run a STOMP server or client are exposed; a service with no vertx-stomp on the classpath can skip this.","fix":"Upgrade io.vertx:vertx-stomp to 4.5.36 (4.x line) or 5.2.3 (5.x line). The vendor lists no workarounds.","status":"open","published_at":"2026-11-03T16:17:19+00:00","first_seen_at":"2026-11-03T16:21:42+00:00","triaged_at":"2026-11-03T16:23:52+00:00","updated_at":"2026-11-03T16:25:37+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-03T16:23:52Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release outside the affected ranges: `4.5.36` or later on the 4.x line, or `5.2.3` or later on the 5.x line (the sources list the ranges; the exact fixed versions are inferred from them, verify against the advisory).","reach":"network","title":"Eclipse Vert.x STOMP: unbounded frame buffering lets a peer exhaust memory","impact":"high","summary":"The vertx-stomp FrameParser builds a RecordParser with no maxRecordSize, so it buffers bytes without a newline indefinitely. A connected peer can stream data to exhaust JVM heap and crash the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","vert.x","stomp","jvm"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote peer crashes the service by exhausting JVM heap memory","analyst_note":"Confirm the fixed versions and the vendor advisory (linked as github.com) since the sources only give the affected ranges.","how_to_check":"- Check the vertx-stomp version in your build file (Maven or Gradle) against the affected ranges.\n- Look for `io.vertx:vertx-stomp` on the classpath of any service that runs a STOMP server or client.","plain_action":"","needs_analyst":true,"not_affected_if":["no-stomp-module","vert.x-outside-affected-ranges"],"who_is_affected":"Applications that embed vertx-stomp to run a STOMP server or act as a STOMP client. A malicious server can hit a connecting client, and a malicious client can hit a server, before or after authentication. Services that do not use the STOMP module are not exposed through this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000743,"input_tokens":4276,"output_tokens":630,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and the vendor advisory (linked as github.com) since the sources only give the affected ranges.","search":"'-118487':14A,17A '-2026':13A,16A '4.0.0':64C '4.5.35':65C '5.0.0':67C '5.2.2':68C 'accumul':96C 'affect':108C,142C 'authent':132C 'buffer':6A,40B 'build':32B 'byte':41B,86C,134C 'caus':92C,145C 'charact':91C 'client':106C,118C,122C 'complet':147C 'connect':47B,117C 'continu':87C 'crash':57B,140C 'creat':75C 'cve':12A,15A 'data':51B,97C 'denial':148C 'eclips':1A,61C 'exhaust':10A,53B,136C 'exploit':113C,124C 'frame':5A 'framepars':31B,70C 'heap':55B,138C 'indefinit':45B,98C 'io.vertx':18A 'java':22B 'jvm':23B,54B,137C 'let':7A 'malici':110C,121C 'maxrecords':37B,80C 'memori':11A,139C 'newlin':44B,90C 'packag':24B 'parser':94C 'peer':9A,48B,83C 'process':59B,143C 'recordpars':34B,77C 'server':102C,111C,128C 'servic':150C 'set':79C 'stomp':3A,21A,25B,30B,74C,101C,105C 'stream':50B,85C,135C 'sustain':133C 'unbound':4A 'version':63C 'vert.x':2A,26B,62C 'vertx':20A,29B,73C 'vertx-stomp':19A,28B,72C 'without':42B,78C,88C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed io.vertx:vertx-stomp (<= 4.5.35, or 5.0.0 to 5.2.2) to run a STOMP server or act as a STOMP client. A malicious peer can stream bytes without a newline to exhaust JVM heap, against a server (before or after authentication) or against a connecting client. Services without the STOMP module, or on 4.5.36 / 5.2.3 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T16:25:37Z","by":"analyst","doc":"https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7","run_id":1506},"products":{"at":"2026-11-03T16:25:37Z","by":"analyst","doc":"https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7","run_id":1506},"how_to_check":{"at":"2026-11-03T16:25:37Z","by":"analyst","doc":"https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7","run_id":1506},"who_affected":{"at":"2026-11-03T16:25:37Z","by":"analyst","doc":"https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7","run_id":1506}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["iovertxvertxstomp"],"ptokens":["io","stomp","vertx"],"labels":["high","java","jvm","package","stomp","vertx"],"campaign_type":null,"first_public_at":"2026-11-03T10:01:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118487","severity":null,"published_at":"2026-11-03T16:17:19+00:00","modified_at":"2026-11-03T16:17:19+00:00","first_seen_at":"2026-11-03T16:21:42+00:00","fetched_at":"2026-11-03T16:21:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118487:1506","url":null,"severity":null,"published_at":"2026-11-03T16:25:37+00:00","modified_at":"2026-11-03T16:25:37+00:00","first_seen_at":"2026-11-03T16:25:37+00:00","fetched_at":"2026-11-03T16:25:37+00:00","note":"Read GHSA-cchp-hff9-j7q7 (vendor advisory): affected <=4.5.35 and 5.0.0-5.2.2; patched 4.5.36, 5.2.3; no workarounds listed. No exploitation or PoC found."}],"documents":[{"id":58800,"url":"https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T10:01:55+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}