CVE-2026-102467

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is...

CVE-2026-102476

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and...

ai.stapi:arango-axon (>=0.0.1, <=0.0.2), ai.stapi:arango-graph (>=0.0.1, <=0.0.2) +3035 more potentially affected by CVE-2026-6860 via io.vertx:vertx-core (>=4.4.0, <=4.4.9)

io.vertx:vertx-core MAVEN version =4.4.0, =0.0.1, =0.0.1, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =23.3.0, =23.3.0, =23.3.0, =23.9.1 and more Source cves: CVE-2026-6860 Source advisory: GHSA-3G76-F9XQ-8VP6...

ai.tock:bot-test (>=25.9.0, <=26.3.2), ai.tock:bot-test-base (>=25.9.0, <=26.3.2) +888 more potentially affected by CVE-2026-6860 via io.vertx:vertx-core (>=5.0.0, <=5.0.11)

io.vertx:vertx-core MAVEN version =5.0.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =26.3.2 and more Source cves: CVE-2026-6860 Source advisory: OSV:GHSA-3G76-F9XQ-8VP6...

ai.tock:bot-test (>=25.9.0, <=26.3.2), ai.tock:bot-test-base (>=25.9.0, <=26.3.2) +888 more potentially affected by CVE-2026-6860 via io.vertx:vertx-core (>=5.0.0, <=5.0.11)

io.vertx:vertx-core MAVEN version =5.0.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =26.3.2 and more Source cves: CVE-2026-6860 Source advisory: GHSA-3G76-F9XQ-8VP6...

ai.stapi:arango-axon (>=0.0.1, <=0.0.2), ai.stapi:arango-graph (>=0.0.1, <=0.0.2) +3035 more potentially affected by CVE-2026-6860 via io.vertx:vertx-core (>=4.4.0, <=4.4.9)

io.vertx:vertx-core MAVEN version =4.4.0, =0.0.1, =0.0.1, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =0.9.39, =23.3.0, =23.3.0, =23.3.0, =23.9.1 and more Source cves: CVE-2026-6860 Source advisory: OSV:GHSA-3G76-F9XQ-8VP6...

ai.tock:bot-test (>=25.9.0, <=26.3.2), ai.tock:bot-test-base (>=25.9.0, <=26.3.2) +896 more potentially affected by CVE-2026-6860 via io.vertx:vertx-core (>=5.0.0.cr1, <=5.0.11)

io.vertx:vertx-core MAVEN version =5.0.0.cr1, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =26.3.2 and more Source cves: CVE-2026-6860 Source advisory: SNYK:JAVA-IOVERTX-16433278...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +6842 more potentially affected by CVE-2026-6860 via io.vertx:vertx-core (>=4.3.4, <=4.5.26)

io.vertx:vertx-core MAVEN version =4.3.4, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91,...

ai.tock:bot-test (>=25.9.0, <=26.3.2), ai.tock:bot-test-base (>=25.9.0, <=26.3.2) +888 more potentially affected by CVE-2026-6860 via io.vertx:vertx-core (>=5.0.0, <=5.0.11)

io.vertx:vertx-core MAVEN version =5.0.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =26.3.2 and more Source cves: CVE-2026-6860 Source advisory: MEND:CVE-2026-6860...

com.cyngn.vertx:vertx-kafka (>=0.4.0, <=0.4.1), com.cyngn.vertx:vertx-opentsdb (0.7.0) +123 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (3.1.0)

io.vertx:vertx-core MAVEN version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - com.cyngn.vertx:vertx-kafka =0.4.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.2.0 -...

com.ecfront:ez-rpc (>=1.7, <=1.9.7), com.englishtown.vertx:vertx-cassandra (>=3.0.0-rc3, <=3.0.0-rc4) +37 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (3.0.0-milestone3)

io.vertx:vertx-core MAVEN version 3.0.0-milestone3 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - com.ecfront:ez-rpc =1.7, =3.0.0-rc3, =3.0.0-rc4 - com.englishtown.vertx:vertx-cassandra-binarystore 2.0.0-rc2 ...

com.diabolicallabs:vertx-cron (3.8.4), com.github.erosb:openapi-operation-vertx (>=2.0.0-rc1, <=2.0.0-rc4) +411 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (3.8.3)

io.vertx:vertx-core MAVEN version 3.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - com.diabolicallabs:vertx-cron 3.8.4 - com.github.erosb:openapi-operation-vertx =2.0.0-rc1, =1.1, =1.1, =1.1, =1.0,...

com.goodow.vertx:vertx-mod-elasticsearch (1.1.1), io.vertx:lang-js (1.1.0) +4 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (2.1rc3)

io.vertx:vertx-core MAVEN version 2.1rc3 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - com.goodow.vertx:vertx-mod-elasticsearch 1.1.1 - io.vertx:lang-js 1.1.0 - io.vertx:lang-rhino 2.1.1 -...

io.vertx:vertx-amqp-bridge (3.5.2.cr3), io.vertx:vertx-amqp-bridge-scala_2.12 (3.5.2.cr3) +157 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (3.5.2.cr3)

io.vertx:vertx-core MAVEN version 3.5.2.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - io.vertx:vertx-amqp-bridge 3.5.2.cr3 - io.vertx:vertx-amqp-bridge-scala2.12 3.5.2.cr3 - io.vertx:vertx-auth 3.5.2.cr3...

be.fluid-it.reactive-microservice.bundle:bootique-vertx (>=0.1-0, <=0.1-7), be.fluid-it.reactive-microservice.bundle:reactive-microservice-bundle-core (>=0.1-0, <=0.1-7) +308 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (3.4.1)

io.vertx:vertx-core MAVEN version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - be.fluid-it.reactive-microservice.bundle:bootique-vertx =0.1-0, =0.1-0, =3.1.1, =3.1.1, =1.0.0, =0.5.0, =1.0.0, =1.4.0,...

io.github.jponge:vertx-boot (0.0.2), io.vertx:vertx-amqp-bridge (3.5.2.cr1) +158 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (3.5.2.cr1)

io.vertx:vertx-core MAVEN version 3.5.2.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - io.github.jponge:vertx-boot 0.0.2 - io.vertx:vertx-amqp-bridge 3.5.2.cr1 - io.vertx:vertx-amqp-bridge-scala2.12...

as.leap:vertx-rpc (3.0.0-rc1), com.englishtown.vertx:vertx-cassandra (3.0.0-rc6) +37 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (3.0.0-milestone5)

io.vertx:vertx-core MAVEN version 3.0.0-milestone5 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - as.leap:vertx-rpc 3.0.0-rc1 - com.englishtown.vertx:vertx-cassandra 3.0.0-rc6 -...

io.vertx:vertx-hazelcast (2.1rc2), io.vertx:vertx-maven-plugin (2.0.5-final) +6 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (2.1rc2)

io.vertx:vertx-core MAVEN version 2.1rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - io.vertx:vertx-hazelcast 2.1rc2 - io.vertx:vertx-maven-plugin 2.0.5-final - io.vertx:vertx-platform 2.1rc2 -...

info.freelibrary:vertx-pairtree (0.0.1), io.vertx:vertx-amqp-bridge (3.4.0.beta1) +128 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (3.4.0.beta1)

io.vertx:vertx-core MAVEN version 3.4.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - info.freelibrary:vertx-pairtree 0.0.1 - io.vertx:vertx-amqp-bridge 3.4.0.beta1 - io.vertx:vertx-amqp-bridge-scala2....

br.com.ingenieux:jbake-maven-plugin (>=0.0.3, <=0.0.9), io.github.flowersinthesand:wes-vertx2 (>=0.1.0, <=0.2.1) +4 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (2.0.2-final)

io.vertx:vertx-core MAVEN version 2.0.2-final is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - br.com.ingenieux:jbake-maven-plugin =0.0.3, =0.1.0, =2.0.2-final, =2.0.3, =2.0.7 Source cves: CVE-2026-1002 Source...