CVE-2026-118487

In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, the FrameParser in vertx-stomp creates a RecordParser without setting maxRecordSize, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the...

CVE-2026-118487 Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser

In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, the FrameParser in vertx-stomp creates a RecordParser without setting maxRecordSize, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the...

EUVD-2026-115915

In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, the FrameParser in vertx-stomp creates a RecordParser without setting maxRecordSize, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the...

CVE-2026-118487

Eclipse Vert.x versions [4.0.0, 4.5.35] and [5.0.0, 5.2.2] are vulnerable to a heap exhaustion flaw in the FrameParser component of vertx-stomp . The root cause is the creation of a RecordParser without specifying a maxRecordSize, allowing a peer to stream bytes continuously without a newline cha...

CVE-2026-118487: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser`…

In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, the FrameParser in vertx-stomp creates a RecordParser without setting maxRecordSize, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the...