CVE-2026-102461

State: Published
Severity: 8.7 High
Published: Oct 15, 2026
Updated: Oct 16, 2026
Reserved: Sep 29, 2026

Description

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time, leading to denial of service.

The impacted component is io.vertx:vertx-json-schema.

The following Vert.x modules depend on vertx-json-schema and are also affected:

io.vertx:vertx-web-openapi-router io.vertx:vertx-web-validation io.vertx:vertx-openapi

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	eclipse

Weaknesses

CWE-407 Inefficient Algorithmic Complexity

Affected Products

Product	Versions
Eclipse Vert.xEclipse Foundation	4.0.0 through 4.5.34Affected 5.0.0 through 5.0.12Affected 5.1.0 through 5.1.9Affected 5.2.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.