The vulnerability resides in the body‑transformer interceptor of the Eclipse Vert.x http‑proxy component. In affected releases the check that limits the amount of data buffered in memory is omitted, allowing an attacker who can activate the interceptor to force the proxy into an unbounded heap allocation. This flaw, identified as CWE‑770 (Uncontrolled Resource Consumption), represents a classic resource exhaustion weakness where the lack of a maximum buffer length permits unlimited memory usage. When the application eventually runs out of JVM heap, it crashes or becomes unresponsive, resulting in a denial of service for legitimate users.

The issue affects the Eclipse Vert.x http‑proxy library (io.vertx:vertx‑http‑proxy) in the following releases: 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0.

This flaw carries a CVSS score of 8.7, indicating a high severity risk. The EPSS score is below 1 %, implying a low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. An attacker would need to send crafted requests through a reachable proxy instance that triggers the body‑transformer interceptor, making the attack vector application‑level and requiring network access to the service. Successful exploitation leads directly to heap exhaustion, abruptly terminating the application.