Bug 2553096 (CVE-2026-102477)

Summary: CVE-2026-102477 io.vertx/vertx-grpc-server: vertx-grpc-server: Denial of Service via compression bomb
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: ant, aschwart, aszczucz, boliveir, cescoffi, cmah, drichtar, ewittman, fmongiar, gsmet, janstey, jmartisk, jnethert, kaycoth, manderse, mposolda, nipatil, olubyans, ozzy, pantinor, pjindal, rguimara, rkubis, rmartinc, sbiarozk, ssilvert, sthorger, varjain, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Eclipse Vert.x vertx-grpc-server. The server's configured maximum message size limit is enforced only on the received compressed data rather than on the uncompressed payload. A remote attacker can exploit this flaw by sending a specially crafted compressed message, causing excessive memory allocation upon decompression and resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-15 08:32:56 UTC 
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed size and not the actual size of the uncompressed content. This can be used to force a gRPC endpoint to allocate more bytes than the value defined by the configuration, making the endpoint vulnerable to compression bomb attacks.



The impacted component is io.vertx:vertx-gprc-server.