In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit (8192 bytes) above which the WebSocket gets an HTTP response with the 413 status code and the connection gets closed.
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vert.x | Eclipse | 3.0.0 (including) | 3.5.4 (excluding) |
| Red Hat Fuse 7.7.0 | RedHat | vertx-core | * |
| Text-Only RHOAR | RedHat | vert-core | * |