CVE-2026-102465: Vulnerability in Eclipse Foundation Eclipse Vert.x

The vulnerability exists in the io.vertx:vertx-mysql-client component of Eclipse Vert.x. The Redis client RESP parser does not limit the size of arrays it pre-allocates based on server-declared lengths. Exploitation involves sending a malicious RESP response with a very large array length, causing the client to attempt a massive heap allocation. This triggers an OutOfMemoryError that crashes the event loop thread, causing denial of service to all connections and verticles on that loop. The affected versions are >=4.0.0 <=4.5.34, >=5.0.0 <=5.0.12, >=5.1.0 <=5.1.9, and =5.2.0. The CVSS 4.0 score is 8.2, indicating high severity, with network attack vector, high attack complexity, and high impact on availability.

Successful exploitation causes the Vert.x event loop thread to crash due to an OutOfMemoryError, resulting in denial of service to all connections and verticles sharing that event loop. This disrupts application availability but does not indicate code execution or data compromise based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid connecting to untrusted or compromised Redis servers and monitor for unusual large RESP array lengths if possible.