Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.SP3)

An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available RHBQ 3.33.4.SP3. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product...

CVE-2026-102477

A flaw was found in Eclipse Vert.x vertx-grpc-server. The server's configured maximum message size limit is enforced only on the received compressed data rather than on the uncompressed payload. A remote attacker can exploit this flaw by sending a specially crafted compressed message, causing...

io.gravitee.apim.gateway:gravitee-apim-gateway-tests-sdk (>=4.12.0-milestone.1, <=4.12.20), io.gravitee.singularitee.engine.api:gravitee-singularitee-engine-api (>=1.3.0, <=1.6.0) +60 more potentially affected by CVE-2026-102477 via io.vertx:vertx-grpc-server (>=5.0.0, <=5.1.9)

io.vertx:vertx-grpc-server MAVEN version =5.0.0, =4.12.0-milestone.1, =1.3.0, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.3.0, =1.0.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.6.0 and more Source cves: CVE-2026-102477https://vuln...

ai.agentican:agentican-quarkus-otel (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-otel-store-jpa (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +663 more potentially affected by CVE-2026-102477 via io.vertx:vertx-grpc-server (>=4.3.0, <=4.5.34)

io.vertx:vertx-grpc-server MAVEN version =4.3.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.4, =0.3.0, =0.3.0, =0.0.22, =0.0.2, =0.0.18 and more Source cves: CVE-2026-102477 Source advisory: SNYK:JAVA-IOVERTX-21715423...

ai.agentican:agentican-quarkus-otel (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-otel-store-jpa (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +663 more potentially affected by CVE-2026-102477 via io.vertx:vertx-grpc-server (>=4.3.0, <=4.5.34)

io.vertx:vertx-grpc-server MAVEN version =4.3.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.4, =0.3.0, =0.3.0, =0.0.22, =0.0.2, =0.0.18 and more Source cves: CVE-2026-102477 Source advisory: MEND:CVE-2026-102477...

io.mishmash.stacks.karaf:karaf-features (1.0.9), io.mishmash.stacks.osgi:wrapper-vertx (5.2.0-mmio.1.0) +10 more potentially affected by CVE-2026-102477 via io.vertx:vertx-grpc-server (5.2.0)

io.vertx:vertx-grpc-server MAVEN version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-grpc-server and may be impacted: - io.mishmash.stacks.karaf:karaf-features 1.0.9 - io.mishmash.stacks.osgi:wrapper-vertx 5.2.0-mmio.1.0 -...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the gzip-decoding path in GrpcReadStreamBase used by GrpcServerRequestImpl. An attacker can send a small gzip-compressed gRPC request that expands beyond the configured...

Moderate: Red Hat Security Advisory: Red Hat build of Quarkus 3.8.6 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more information...

CVE-2024-8391

A flaw was found in the gRPC server in Eclipse Vert.x, which does not limit the maximum length of the message payload. This may lead to excessive memory consumption in a server or a client, causing a denial of service. Mitigation Mitigation for this issue is either not available or the currently...

com.github.nbbrd.sdmx-dl:sdmx-dl-grpc (>=3.0.0-beta.12, <=3.0.0-beta.13), com.github.rebue.wheel:wheel-vertx (>=2.2.9, <=3.5.33) +236 more potentially affected by CVE-2024-8391 via io.vertx:vertx-grpc-server (>=4.3.0, <=4.5.9)

io.vertx:vertx-grpc-server MAVEN version =4.3.0, =3.0.0-beta.12, =2.2.9, =0.30.0, =0.21.0, =4.3.0-alpha.2, =4.3.0-alpha.2, =1.0.0, =1.0.0, =2.8.0, =0.2.0, =0.0.7, =0.0.7, =0.4.0, =0.0.7, =2.7.0.cr1, =3.14.0 and more Source cves: CVE-2024-8391 Source advisory:...

com.github.nbbrd.sdmx-dl:sdmx-dl-grpc (>=3.0.0-beta.12, <=3.0.0-beta.13), com.github.rebue.wheel:wheel-vertx (>=2.2.9, <=3.5.33) +236 more potentially affected by CVE-2024-8391 via io.vertx:vertx-grpc-server (>=4.3.0, <=4.5.9)

io.vertx:vertx-grpc-server MAVEN version =4.3.0, =3.0.0-beta.12, =2.2.9, =0.30.0, =0.21.0, =4.3.0-alpha.2, =4.3.0-alpha.2, =1.0.0, =1.0.0, =2.8.0, =0.2.0, =0.0.7, =0.0.7, =0.4.0, =0.0.7, =2.7.0.cr1, =3.14.0 and more Source cves: CVE-2024-8391 Source advisory:...

GHSA-G76F-GJFX-4RPR Vertx gRPC server does not limit the maximum message size

In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client. This is fixed in the 4.5.10 version. Note this does not affect the Vert.x gRPC server based grpc-java and Netty...

CVE-2024-8391

In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client. This is fixed in the 4.5.10 version. Note this does not affect the Vert.x gRPC server based grpc-java and Netty...