CVE-2026-102464: Vulnerability in Eclipse Foundation Eclipse Vert.x

In Eclipse Vert.x MQTT client (vertx-mqtt) versions >=4.0.0 <=4.5.34, >=5.0.0 <=5.0.12, >=5.1.0 <=5.1.9, and =5.2.0, the internal map (qos2inbound) that holds inbound QoS 2 PUBLISH messages awaiting PUBREL packets has no size limit. The maxInflightQueue option only limits outbound messages and does not constrain inbound message retention. A malicious or compromised MQTT broker can send many QoS 2 PUBLISH messages with unique packet identifiers and withhold PUBREL responses, causing the client to retain all these messages indefinitely. This leads to unbounded memory consumption, which can degrade performance or cause out-of-memory termination of the Vert.x process.

The vulnerability allows a malicious or compromised MQTT broker to cause unbounded memory growth in the Eclipse Vert.x MQTT client by sending numerous QoS 2 PUBLISH messages without completing the QoS 2 handshake. This can degrade the MQTT-consuming application or cause it to terminate due to out-of-memory conditions. There is no indication of remote code execution or data leakage, but denial of service via resource exhaustion is the primary impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting exposure to untrusted MQTT brokers or implementing external controls to detect and block abnormal QoS 2 message patterns. No official fix or patch links are currently provided.