All vulnerabilities
CVE-2026-103224GHSA-75hv-9xj3-3cr8

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffe

Eclipse Foundation Eclipse Vert.x
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.2.1Also 5.1.10, 4.5.35GitHub
Published15 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

  • 5.2.1io.vertx:vertx-mysql-client, mavenGitHub<dependency><groupId>io.vertx</groupId><artifactId>vertx-mysql-client</artifactId><version>5.2.1</version></dependency>
  • 5.1.10io.vertx:vertx-mysql-client, mavenGitHub<dependency><groupId>io.vertx</groupId><artifactId>vertx-mysql-client</artifactId><version>5.1.10</version></dependency>
  • 4.5.35io.vertx:vertx-mysql-client, mavenGitHub<dependency><groupId>io.vertx</groupId><artifactId>vertx-mysql-client</artifactId><version>4.5.35</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes.

The impacted component is io.vertx:vertx-mysql-client.

Text from GitHub Advisory Database

Affected versions 7

  • Eclipse Vert.xaffected: 4.0.0 through 4.5.34CVE List
  • Eclipse Vert.xaffected: 5.0.0 through 5.0.12CVE List
  • Eclipse Vert.xaffected: 5.1.0 through 5.1.9CVE List
  • Eclipse Vert.xaffected: 5.2.0CVE List
  • io.vertx:vertx-mysql-client, maven5.2.0GitHub
  • io.vertx:vertx-mysql-client, maven>=5.0.0, <=5.1.8GitHub
  • io.vertx:vertx-mysql-client, maven<=4.5.34GitHub

References 2