CVE-2026-102477

A flaw was found in Eclipse Vert.x vertx-grpc-server. The server's configured maximum message size limit is enforced only on the received compressed data rather than on the uncompressed payload. A remote attacker can exploit this flaw by sending a specially crafted compressed message, causing...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the gzip-decoding path in GrpcReadStreamBase used by GrpcServerRequestImpl. An attacker can send a small gzip-compressed gRPC request that expands beyond the configured...

ai.agentican:agentican-quarkus-otel (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-otel-store-jpa (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +653 more potentially affected by CVE-2026-102477 via io.vertx:vertx-grpc-server (>=4.3.0, <=4.5.34)

io.vertx:vertx-grpc-server MAVEN version =4.3.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.4, =0.3.0, =0.3.0, =0.0.22, =0.0.2, =0.0.18 and more Source cves: CVE-2026-102477 Source advisory: MEND:CVE-2026-102477...

Moderate: Red Hat Security Advisory: Red Hat build of Quarkus 3.8.6 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more information...

CVE-2024-8391

A flaw was found in the gRPC server in Eclipse Vert.x, which does not limit the maximum length of the message payload. This may lead to excessive memory consumption in a server or a client, causing a denial of service. Mitigation Mitigation for this issue is either not available or the currently...

GHSA-G76F-GJFX-4RPR Vertx gRPC server does not limit the maximum message size

In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client. This is fixed in the 4.5.10 version. Note this does not affect the Vert.x gRPC server based grpc-java and Netty...

com.github.nbbrd.sdmx-dl:sdmx-dl-grpc (>=3.0.0-beta.12, <=3.0.0-beta.13), com.github.rebue.wheel:wheel-vertx (>=2.2.9, <=3.5.33) +236 more potentially affected by CVE-2024-8391 via io.vertx:vertx-grpc-server (>=4.3.0, <=4.5.9)

io.vertx:vertx-grpc-server MAVEN version =4.3.0, =3.0.0-beta.12, =2.2.9, =0.30.0, =0.21.0, =4.3.0-alpha.2, =4.3.0-alpha.2, =1.0.0, =1.0.0, =2.8.0, =0.2.0, =0.0.7, =0.0.7, =0.4.0, =0.0.7, =2.7.0.cr1, =3.14.0 and more Source cves: CVE-2024-8391 Source advisory:...

com.github.nbbrd.sdmx-dl:sdmx-dl-grpc (>=3.0.0-beta.12, <=3.0.0-beta.13), com.github.rebue.wheel:wheel-vertx (>=2.2.9, <=3.5.33) +236 more potentially affected by CVE-2024-8391 via io.vertx:vertx-grpc-server (>=4.3.0, <=4.5.9)

io.vertx:vertx-grpc-server MAVEN version =4.3.0, =3.0.0-beta.12, =2.2.9, =0.30.0, =0.21.0, =4.3.0-alpha.2, =4.3.0-alpha.2, =1.0.0, =1.0.0, =2.8.0, =0.2.0, =0.0.7, =0.0.7, =0.4.0, =0.0.7, =2.7.0.cr1, =3.14.0 and more Source cves: CVE-2024-8391 Source advisory:...

CVE-2024-8391

In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client. This is fixed in the 4.5.10 version. Note this does not affect the Vert.x gRPC server based grpc-java and Netty...