AIKIDO-2026-727484
vertx-core is vulnerable to Denial of Service (DoS)
75
CVE Score
High
Denial of Service (DoS)
TL;DR
vertx-core creates the WebSocket permessage-deflate and deflate-frame handshakers with no limit on decompressed allocation. A peer that negotiates compression can send a small frame or message that expands during inflate and exhausts heap before the configured size checks run. Servers enable both compression extensions by default, so an unauthenticated client can trigger that on a normal WebSocket connection. The fix passes the configured frame or message size plus 512 bytes as the handshaker allocation limit.
How do I fix this?
Upgrade the io.vertx:vertx-core library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and WebSocket compression is enabled on the connection.
Package
Versions
4.0.0 - 4.5.34
Fixed in 4.5.355.0.0 - 5.1.8
Fixed in 5.1.105.2.0 - 5.2.0
Fixed in 5.2.1Background info
vertx-core is vulnerable to Denial of Service (DoS) in versions 4.0.0 - 4.5.34, 5.0.0 - 5.1.8 and 5.2.0 - 5.2.0.
Links
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.