CVE-2026-102462 in Vert.x
Summary
by MITRE • 10/15/2026
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes.
The impacted component is io.vertx:vertx-mssql-client.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Eclipse Vert.x affects the MSSQL client implementation across multiple version ranges, specifically versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0. This security flaw resides within the TDS message decoder component of the vertx-mssql-client library. The core technical issue is a failure to enforce cumulative size limits on inbound Transact-DATA Stream packets during the aggregation process. When the client receives data from a SQL Server, it aggregates these incoming TDS packets into a composite direct-memory buffer. However, this aggregation mechanism lacks any validation or constraint regarding the total size of the accumulated data. Consequently, if an attacker controls the server side, compromises the database server, or intercepts traffic via a man-in-the-middle attack, they can exploit this lack of bounds checking by sending a continuous stream of TDS packets that do not set the END_OF_MESSAGE status flag. This behavior signals to the client that more data is expected, prompting it to continue allocating memory for subsequent packets indefinitely.
The operational impact of this vulnerability is severe, primarily manifesting as an out-of-memory crash on the client application. Because the direct-memory allocation occurs before authentication completes, the attack can be executed against unauthenticated connections, making it particularly dangerous in scenarios where connection pooling or automated database interactions are prevalent. The continuous stream of packets forces the Java Virtual Machine to consume increasing amounts of off-heap memory until the system resources are exhausted. This results in a denial-of-service condition for the affected application and potentially destabilizes the underlying host environment if not properly isolated. The absence of an END_OF_MESSAGE flag is critical because it prevents the decoder from recognizing the logical end of a message, thereby triggering infinite accumulation logic within the buffer management subsystem.
From a classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-789, which pertains to Memory Allocation with Unlimited Input. The attack vector is consistent with ATT&CK technique T1499, Endpoint Denial of Service, specifically through resource exhaustion via application layer flooding. Mitigation strategies must prioritize immediate upgrading to a patched version of the Eclipse Vert.x MSSQL client that implements proper size limits and validation for inbound packet aggregation. In environments where upgrading is not immediately feasible, network-level controls such as rate limiting or deep packet inspection can help mitigate the risk by detecting abnormal volumes of TDS traffic before it reaches the application layer. Additionally, configuring JVM memory limits with appropriate heap and direct buffer constraints may provide a partial safeguard against total system collapse, although this does not address the root cause within the library itself.