CVE-2018-12541 - CVE House
Back to Database
Status published Medium CVE-2018-12541

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the...

Vulnerability Description

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit (8192 bytes) above which the WebSocket gets an HTTP response with the 413 status code and the connection gets closed.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-12541

Credits & Attribution

No credits recorded in the NVD database.

References

More from The Eclipse Foundation

View All →
CVE-2023-0100
In Eclipse BIRT, starting from version 2.6.2, the default configuration...
Unknown 0
CVE-2022-3676
In Eclipse Openj9 before version 0.35.0, interface calls can be...
Unknown 0
CVE-2022-2838
In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser...
Medium 5.3
CVE-2022-2712
In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a...
Medium 6.5
CVE-2022-2576
In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a...
High 7.5

Affected Vendor

The Eclipse Foundation

View all reports →

Affected Software

Eclipse Vert.x
Vulnerable Versions:
3.0, unspecified

Timeline

Official Publish: October 10th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-789

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.