A memory allocation vulnerability in the Vert.x Redis client allows a malicious or compromised Redis server, or an attacker acting as a man‑in‑the‑middle, to send an exceptionally large RESP array, push, or attribute length. The client pre‑allocates arrays based on the declared size without an upper bound, leading to a massive heap allocation that triggers an OutOfMemoryError. This error crashes the Vert.x event loop thread, abruptly terminating all connections and verticles that share that loop and resulting in a denial of service for the entire application.

The affected component is the Eclipse Vert.x framework, specifically the Vert.x Redis client used within Eclipse Foundation’s Eclipse Vert.x product. Versions vulnerable include 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and the single 5.2.0 release. Any deployment of io.vertx:vertx-mysql-client that depends on these Vert.x Redis client versions is at risk.

The vulnerability carries a CVSS score of 8.2, indicating high severity, while the EPSS score is below 1 %, suggesting a very low but non‑zero exploitation probability. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker controlling the Redis server or intercepting traffic between the client and a legitimate server, enabling them to deliver the oversized RESP payload and trigger the crash.