Eclipse Vert.x’s vertx-json-schema component contains a quadratic pairwise comparison loop for evaluating the uniqueItems keyword. Because the loop has no short‑circuit logic or size limit, an attacker can send a moderate‑sized JSON array that forces the validator to consume disproportionate CPU time. This flaw, classified as a time and resource consumption vulnerability (CWE‑407) and as an improper input validation weakness (CWE‑606), gives a remote, unauthenticated attacker a clear path to disrupt application availability without needing further privilege.

Versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 of Eclipse Vert.x are affected. The impact propagates to all modules that depend on vertx-json-schema, notably vertx-web-openapi-router, vertx-web-validation, and vertx-openapi.

The vulnerability has a CVSS score of 8.7, indicating high severity, but the EPSS score is less than 1%, reflecting a low probability of widespread exploitation. It is not listed in CISA’s KEV catalog. Attack is likely achievable from any network position that can reach the application’s JSON endpoints, with the attacker submitting crafted arrays to exhaust CPU resources. The lack of authentication requirements simplifies the threat scenario.