AIKIDO-2026-772275
vertx-http-proxy is vulnerable to Denial of Service (DoS)
75
CVE Score
High
Denial of Service (DoS)
TL;DR
The body-transformer interceptor in vertx-http-proxy is supposed to stop buffering a body once it passes the configured maximum, but the cumulator keeps allocating after that limit. A request body can make the proxy grow the heap without bound when an intercepting transformer is installed. The fix applies the maximum to the bytes the cumulator actually buffers.
How do I fix this?
Upgrade the io.vertx:vertx-http-proxy library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the proxy installs an intercepting body transformer.
Package
Versions
5.0.0 - 5.1.8
Fixed in 5.1.105.2.0 - 5.2.0
Fixed in 5.2.1Background info
vertx-http-proxy is vulnerable to Denial of Service (DoS) in versions 5.0.0 - 5.1.8 and 5.2.0 - 5.2.0.
Links
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.