Description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time, leading to denial of service.



The impacted component is io.vertx:vertx-json-schema.



The following Vert.x modules depend on vertx-json-schema and are also affected:



io.vertx:vertx-web-openapi-router io.vertx:vertx-web-validation io.vertx:vertx-openapi
Published: 2026-10-15
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:vert.x:5.2.0:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Mon, 19 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse vert.x
Vendors & Products Eclipse
Eclipse vert.x

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title DoS via O(n^2) UniqueItems Validation in Vert.x JSON Schema io.vertx/vertx-json-schema: vertx-json-schema: Denial of Service via inefficient uniqueItems array validation
Weaknesses CWE-606
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

threat_severity

Important

Fri, 16 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Title DoS via O(n^2) UniqueItems Validation in Vert.x JSON Schema

Fri, 16 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-407

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes disproportionate CPU time, leading to denial of service. The impacted component is io.vertx:vertx-json-schema. The following Vert.x modules depend on vertx-json-schema and are also affected: io.vertx:vertx-web-openapi-router io.vertx:vertx-web-validation io.vertx:vertx-openapi
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Eclipse Vert.x
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-10-16T18:40:19.187Z

Reserved: 2026-09-29T08:25:01.312Z

Link: CVE-2026-102461

cve-icon Vulnrichment

Updated: 2026-10-16T18:40:03.520Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-15T09:17:14.887

Modified: 2026-10-20T19:29:39.003

Link: CVE-2026-102461

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-15T08:23:54Z

Links: CVE-2026-102461 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T14:01:55Z

Weaknesses