Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-102461: Eclipse Vert.x JSON schema can overload server CPU
CVE-2026-102461 · published 20 days ago
Summary
Versions of Eclipse Vert.x that use the vertx-json-schema component may spend a lot of processor time when they check large JSON lists for duplicate items. An unauthenticated remote user could send a moderately sized list that makes the server work excessively hard, potentially slowing or stopping the service. Update to a newer Vert.x release or apply the vendor’s patch to fix the validation logic.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| eclipse foundation | eclipse vert.x | <= 4.5.34 |
| eclipse | vert.x |
>= 4.5.0, < 4.5.35 >= 5.0.0, < 5.1.10 5.2.0 cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* |
Original advisory text
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or s...
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time, leading to denial of service.
The impacted component is io.vertx:vertx-json-schema.
The following Vert.x modules depend on vertx-json-schema and are also affected:
io.vertx:vertx-web-openapi-router io.vertx:vertx-web-validation io.vertx:vertx-openapi
The impacted component is io.vertx:vertx-json-schema.
The following Vert.x modules depend on vertx-json-schema and are also affected:
io.vertx:vertx-web-openapi-router io.vertx:vertx-web-validation io.vertx:vertx-openapi
References
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/340 URL
- https://github.com/eclipse-vertx/vertx-json-schema/security/advisories/GHSA-4m87... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1024... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102461 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.3
High
Type
CWE-407Inefficient Algorithmic Complexity
Timeline
Published15 Oct 2026
Updated4 Nov 2026
First seen15 Oct 2026
Sources
CVE-2026-102461 · NVD
CVE-2026-102461 · MITRE
CVE-2026-102461 · OSV
GHSA-4m87-8qfr-8p8m · GHSA
Track software like this
Free during beta