A gRPC server in Eclipse Vert.x enforces a per‑message maximum size only on the compressed payload, not on the original uncompressed content. An attacker can therefore send a very small compressed packet that expands into a huge amount of data in memory, causing the server to allocate far more resources than the configured limit. This leads to a denial of service, potentially freezing or crashing the application, and can affect all endpoints that accept compressed messages. The weakness belongs to the CWE‑409 class of size and resource management flaws.

The vulnerability exists in the io.vertx:vertx-gprc-server component of Eclipse Vert.x for the following ranges: 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and the single release 5.2.0. Any deployment using those versions and enabling compressed gRPC messages is potentially affected.

The CVSS score is 8.7, categorizing the issue as high severity. The EPSS score is below 1%, indicating that the observed exploitation probability is very low, and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is network access to an exposed gRPC endpoint; based on the description, it is inferred that an attacker must send compressed messages that exceed the server’s configured size limit. Because the flaw triggers a memory allocation failure, a successful exploit can cause crashes or hangs, providing attackers with a reliable denial‑of‑service vector.