Is CVE-2026-102465 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102465 being exploited in the wild.

How severe is CVE-2026-102465?

Medium severity, with a CVSS score of 5.9, published 15 October 2026.

Which products and versions are affected?

Eclipse Vert.x Redis client [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], [5.2.0].

Is there a fix for CVE-2026-102465?

Yes: fixed in Vert.x Redis client 4.5.35, 5.1.10, 5.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102465 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-102465?

Check whether you run Eclipse Vert.X or Eclipse Vert.x Redis client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102465: Eclipse Vert.x Redis client heap exhaustion in RESP parser

CVE-2026-102465 · Severity: medium · CVSS 5.9 · Published 2026-10-15

Eclipse Vert.x is a popular framework for building reactive applications in Java. The Redis client component fails to validate array sizes declared by a Redis server, allowing a malicious or compromised server—or an attacker intercepting the connection—to trigger massive memory allocation and crash the application, disrupting all services using the affected event loop.

Technologies: Eclipse Vert.X. Vendors: Eclipse.

Quick answers

Is CVE-2026-102465 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102465 being exploited in the wild.
How severe is CVE-2026-102465?: Medium severity, with a CVSS score of 5.9, published 15 October 2026.
Which products and versions are affected?: Eclipse Vert.x Redis client [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], [5.2.0].
Is there a fix for CVE-2026-102465?: Yes: fixed in Vert.x Redis client 4.5.35, 5.1.10, 5.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102465 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-102465?: Check whether you run Eclipse Vert.X or Eclipse Vert.x Redis client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Vert.x Redis client 4.5.35, 5.1.10, 5.2.1

Technical details

The RESP (REdis Serialization Protocol) parser in the Vert.x Redis client pre-allocates arrays without enforcing an upper bound on declared lengths. An attacker controlling or intercepting the Redis connection can send a crafted RESP response with an extremely large array length, causing an OutOfMemoryError that crashes the event loop thread and denies service to all verticles sharing that loop. This requires network access to the Redis server or a position on the network path (MITM), with no authentication or user interaction required.

Affected products

Eclipse Vert.x Redis client [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], [5.2.0]

Timeline

2026-10-07: disclosed
2026-10-15: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.