CVE-2026-118487
Last modified
CVE-2026-118487 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication.
Description
In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse Vert.x | >= 4.0.0, <= 4.5.35; >= 5.0.0, <= 5.2.2 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-118487?
How severe is CVE-2026-118487?
How do I fix CVE-2026-118487?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11846The iVEC-IEI Virtualization Edge Computer developed by IEI …8.1
- CVE-2026-11847The iVEC-IEI Virtualization Edge Computer developed by IEI…4.3
- CVE-2026-118475A flaw was found in Eye of GNOME. When parsing a specially c…3.6
- CVE-2026-118477The ei_git_repo_url parameter in the Git remote configuratio…9.8
- CVE-2026-11848The iRM-IEI Remote Management developed by IEI Integration C…5.3
- CVE-2026-118485Axel Download Accelerator 2.17.14 and earlier performs URL p…8.1
- CVE-2026-118488In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2]…5.9
- CVE-2026-118489In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], …7.5
- CVE-2026-11849The iRM-IEI Remote Management developed by IEI Integration …9.8
- CVE-2026-1185A configuration file on the local file system had improper i…8.8
- CVE-2026-11850An integer underflow vulnerability was found in MIT krb5 in …5
- CVE-2026-118500The Cool FormKit Lite – Advanced Form Builder for Elementor …6.4
Are you affected by CVE-2026-118487?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST