CVE-2026-118487
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Nov 3, 2026
CISA due date
—
The record
In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-116646 Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response. CWE-770
- CVE-2026-111751 Angular is a development platform for building mobile and desktop web applications using… CWE-770
- CVE-2026-63501 ag-psd is a JavaScript library for reading and writing Photoshop Document files. CWE-770
- CVE-2026-115715 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead… CWE-770
- CVE-2026-115716 Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to… CWE-770
- CVE-2026-108147 An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13… CWE-770
- CVE-2026-121412 FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption… CWE-770
- CVE-2026-121405 FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP… CWE-770