# CVE-2026-118488: Eclipse Vert.x Redis client unbounded buffer allocation

Source: https://junglewise.ai/threats/cve-2026-118488-in-eclipse-vert-x-versions-4-0-0-4-5-35-or-5-0-0-5-2-2-when-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-118488 · Severity: medium · CVSS 5.9 · Published 2026-11-03

Eclipse Vert.x Redis client is a library that enables applications to communicate with Redis databases. A malicious Redis server can send specially crafted responses that cause the client to allocate unbounded amounts of memory, either by growing a buffer indefinitely or entering an infinite parsing loop. This can exhaust available heap memory and crash the application.

Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-118488 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118488 being exploited in the wild.

**How severe is CVE-2026-118488?** Medium severity, with a CVSS score of 5.9, published 3 November 2026.

**Which products and versions are affected?** Eclipse Vert.x Redis client [4.0.0, 4.5.35] or [5.0.0, 5.2.2].

**Is there a fix for CVE-2026-118488?** Yes: fixed in 5.2.3, 4.5.36. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118488 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118488?** Check whether you run Eclipse Vert.x Redis client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.2.3, 4.5.36

## Technical details

The vulnerability exists in the RESP protocol parser used by the Redis client. Two attack vectors are possible: (1) sending bytes on an EOL-terminated line without proper length-prefixing, causing unbounded buffer growth, and (2) sending a malformed bulk string with missing CRLF trailer, triggering an infinite parser loop that repeatedly emits the same response. Both conditions lead to out-of-memory exhaustion when the consumer buffers responses.

## Affected products

- Eclipse Vert.x Redis client [4.0.0, 4.5.35] or [5.0.0, 5.2.2]

## Timeline

- 2026-11-03: disclosed

## References

- [https://github.com/vert-x3/vertx-redis-client/security/advisories/GHSA-7f58-g87w-gx7p](https://github.com/vert-x3/vertx-redis-client/security/advisories/GHSA-7f58-g87w-gx7p)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/522](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/522)

## Related threats

- [Eclipse Vert.x Redis client heap exhaustion in RESP parser](https://junglewise.ai/threats/cve-2026-102465-in-eclipse-vert-x-versions-4-0-0-4-5-34-or-5-0-0-5-0-12-or-5-1-0)