4.5.36 Release Notes

vulnerabilities

• CVE-2026-118487: Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser
• CVE-2026-118489: CachingWebClient shares user-specific HTTP responses across users via the shared cache tier
• CVE-2026-118488: Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client

vertx-sql-client

• [4.x] Fix caching_sha2_password auth over Unix domain sockets
• Evict cached statements on schema change for tables with 10+ columns
• PG client: cached prepared statement is never evicted after a schema change on tables with 10+ columns
• Cancel pool connection timeout timer when acquisition fails
• SqlConnectionPool.execute() does not cancel the connection-timeout timer when acquire fails → IllegalStateException: Result is already complete

vertx-dependencies

• Upgrade to Netty 4.1.140.Final
• Bump com.fasterxml.jackson:jackson-bom from 2.21.7 to 2.21.8

vert.x

• Upgrade test dependencies to match Netty versions
• Improve server un-sollicited WebSocket messages during handshake.
• Fix SimpleConnectionPool Waiters#addFirst linking the new node to head.prev instead of head.next
• Avoid NPE when a queued HTTP/1.1 request closes before response creation
• Backport PROXY protocol v2 TLV support to 4.x
• Backport PROXY protocol v2 TLV support to Vert.x 4.x
• HTTP/1 queued request close throws NPE and skips connection closeHandler

vertx-tcp-eventbus-bridge

• Add more transports, schema validation and refactorings