CVE-2026-102464

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Eclipse Vert.x MQTT vertx-mqtt MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map qos2inbound while awaiting the corresponding PUBREL packet to complete the...

CVE-2026-102464

The io.vertx:vertx-mqtt component in Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and [5.2.0, 5.2.0] is vulnerable to unbounded memory growth . The MqttClient stores inbound QoS 2 PUBLISH messages in an internal map (qos2inbound ) while awaiting a PUBREL packet. Becau...

CVE-2026-102464

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Eclipse Vert.x MQTT vertx-mqtt MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map qos2inbound while awaiting the corresponding PUBREL packet to complete the...

EUVD-2026-101936

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Eclipse Vert.x MQTT vertx-mqtt MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map qos2inbound while awaiting the corresponding PUBREL packet to complete the...

CVE-2026-8741: Concurrent Execution using Shared Resource with Improper Synchronization

A vulnerability has been found in EMQX up to 6.2.0. This affects an unknown function of the file apps/emqx/src/emqxpersistentsessionds.erl of the component QoS 2 PUBLISH Packet Handler. Such manipulation leads to race condition. The attack may be performed from remote. A high complexity level is...