The WebSocket implementation in Eclipse Vert.x does not impose a maximum size when decompressing frames, enabling an attacker to send a compressed payload that expands to a massive uncompressed size. This can exhaust the server's memory, allowing a zip‑bomb style denial‑of‑service attack. The vulnerability is characterized by uncontrolled resource consumption (CWE-770).

Affected versions include Eclipse Vert.x 4.x from 4.0.0 to 4.5.34, 5.0.x from 5.0.0 to 5.0.12, 5.1.x from 5.1.0 to 5.1.9, and 5.2.0. The vulnerable component is io.vertx:vertx-core.

The CVSS score of 8.7 indicates a high severity, yet the EPSS score is < 1%, implying a low probability of immediate exploitation. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attack vector is remote, as WebSocket connections are typically exposed over the network and the flaw occurs during the receipt of compressed frames. An attacker can open a channel, send a specially crafted compressed frame, and force the server to allocate excessive memory without needing local privileges. Given the potential for resource exhaustion, prompt remediation is recommended.