CVE-2026-102466: Vulnerability in Eclipse Foundation Eclipse Vert.x

Eclipse Vert.x versions >=4.0.0 <=4.5.34, >=5.0.0 <=5.0.12, >=5.1.0 <=5.1.9, and =5.2.0 contain a vulnerability in the vertx-mysql-client component. The client allocates memory for column definitions based on a server-declared column count without upper-bound validation. An attacker controlling the MySQL server or positioned as a man-in-the-middle can send a crafted result set with an extremely large column count, triggering a massive heap allocation attempt. This causes an OutOfMemoryError that crashes the Netty event loop thread, leading to a complete denial of service affecting all connections and verticles in the Vert.x application.

Successful exploitation causes the Vert.x MySQL client to crash due to an OutOfMemoryError, which in turn crashes the Netty event loop thread. This results in a complete denial of service for all connections and verticles within the affected Vert.x application. There is no indication of data compromise or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid connecting to untrusted or potentially compromised MySQL servers and consider network-level protections to prevent man-in-the-middle attacks.