In Eclipse Vert.x Redis client versions between 4.0.0 and 4.5.35, and between 5.0.0 and 5.2.2, the client will accept EOL‑terminated simple strings or bulk strings from a server without enforcing a maximum length. The parser will keep enlarging its internal buffer until memory exhaustion occurs, resulting in an out‑of‑memory condition. A second flaw allows a specially crafted RESP bulk string that lacks the required CRLF trailer to cause the parser to loop indefinitely on the same data, potentially feeding a consumer with repeated responses and leading to further memory consumption or an OOM. The primary impact is a denial of service by exhausting application memory resources.

The vulnerability affects the Eclipse Vert.x framework, specifically the Vert.x Redis client component. Affected releases include Vert.x 4.0.0 through 4.5.35 and Vert.x 5.0.0 through 5.2.2. Applications that use any of these versions to communicate with a Redis server are at risk if the server sends oversized or malformed responses.

The CVSS score of 5.9 places the vulnerability in a moderate severity range. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. A remote attacker who can control or manipulate the Redis server can send malicious RESP data to any application utilizing a vulnerable Vert.x client. Crafting an unlimited sequence of simple strings or a malformed bulk string would cause the client to continually consume memory or spin in an endless parse loop, leading to an application crash or a denial of service.