---
id: CVE-2026-118487
title: Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser
summary: "In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser`\_in vertx-stomp creates a\_`RecordParser`\_without setting\_`maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the p…"
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-770
vendor: Eclipse Foundation
product: Eclipse Vert.x
affected:
  - eclipse_vert.x >= 4.0.0 <= 4.5.35
  - eclipse_vert.x >= 5.0.0 <= 5.2.2
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-03T15:45:05.420912Z'
exploitAvailable: true
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T15:45:31.203Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118487'
references:
  - url: >-
      https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/521'
  - url: 'https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/864'
tags:
  - cve.org
  - exploit-available
epss: 0.00664
epssPercentile: 0.51847
ingestedAt: '2026-11-05T20:33:06.272Z'
---

## Overview

In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.

## Affected

- `eclipse_vert.x >= 4.0.0 <= 4.5.35`
- `eclipse_vert.x >= 5.0.0 <= 5.2.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.