All vulnerabilities
CVE-2026-103223GHSA-hm2j-xp3c-jff2

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol

Eclipse Foundation Eclipse Vert.x
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.2.1Also 5.1.10, 4.5.35GitHub
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 5.2.1io.vertx:vertx-pg-client, mavenGitHub<dependency><groupId>io.vertx</groupId><artifactId>vertx-pg-client</artifactId><version>5.2.1</version></dependency>
  • 5.1.10io.vertx:vertx-pg-client, mavenGitHub<dependency><groupId>io.vertx</groupId><artifactId>vertx-pg-client</artifactId><version>5.1.10</version></dependency>
  • 4.5.35io.vertx:vertx-pg-client, mavenGitHub<dependency><groupId>io.vertx</groupId><artifactId>vertx-pg-client</artifactId><version>4.5.35</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes.

The impacted component is io.vertx:vertx-pg-client.

Text from GitHub Advisory Database

Affected versions 7

  • Eclipse Vert.xaffected: 4.0.0 through 4.5.34CVE List
  • Eclipse Vert.xaffected: 5.0.0 through 5.0.12CVE List
  • Eclipse Vert.xaffected: 5.1.0 through 5.1.9CVE List
  • Eclipse Vert.xaffected: 5.2.0CVE List
  • io.vertx:vertx-pg-client, maven5.2.0GitHub
  • io.vertx:vertx-pg-client, maven>=5.0.0, <=5.1.8GitHub
  • io.vertx:vertx-pg-client, maven<=4.5.34GitHub

References 2