---
id: "CVE-2026-118487"
kind: "vulnerability"
aliases: ["CVE-2026-118487"]
title: "Eclipse Vert.x STOMP: unbounded frame buffering lets a peer exhaust memory"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "io.vertx:vertx-stomp", "fixed": ["4.5.36", "5.2.3"], "affected": "<= 4.5.35; >= 5.0.0, <= 5.2.2", "ecosystem": "maven"}]
ecosystems: []
tags: ["java", "jvm", "package", "stomp", "vert.x"]
not_affected_if: ["no-stomp-module", "vert.x-outside-affected-ranges"]
published_at: "2026-11-03T16:17:19+00:00"
first_seen_at: "2026-11-03T16:21:42+00:00"
updated_at: "2026-11-03T16:25:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118487", "first_seen_at": "2026-11-03T16:21:42+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T16:25:37+00:00"}]
---

# Eclipse Vert.x STOMP: unbounded frame buffering lets a peer exhaust memory

The vertx-stomp FrameParser builds a RecordParser with no maxRecordSize, so it buffers bytes without a newline indefinitely. A connected peer can stream data to exhaust JVM heap and crash the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:io.vertx:vertx-stomp affected <= 4.5.35; >= 5.0.0, <= 5.2.2 fixed 4.5.36, 5.2.3

## How to check

- Run mvn dependency:tree or gradle dependencies and look for io.vertx:vertx-stomp (or the Vert.x BOM version): affected if <= 4.5.35 or 5.0.0 to 5.2.2.
- Only services that run a STOMP server or client are exposed; a service with no vertx-stomp on the classpath can skip this.

## Fix

Upgrade io.vertx:vertx-stomp to 4.5.36 (4.x line) or 5.2.3 (5.x line). The vendor lists no workarounds.

## Timeline

- 2026-11-03T16:21:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118487
- 2026-11-03T16:25:37+00:00 analyst — Read GHSA-cchp-hff9-j7q7 (vendor advisory): affected <=4.5.35 and 5.0.0-5.2.2; patched 4.5.36, 5.2.3; no workarounds listed. No exploitation or PoC found.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7

## From the sources

In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_