CVE-2026-102469: Vulnerability in Eclipse Foundation Eclipse Vert.x

The vulnerability in Eclipse Vert.x's DB2 client (vertx-db2-client) involves unsafe deserialization of User Defined Type (UDT) column data via a bare ObjectInputStream.readObject() call without an ObjectInputFilter or class allowlist. This code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50), a type not supported by legitimate DB2 servers. A malicious or man-in-the-middle DRDA server can craft such a response, causing the client to deserialize attacker-controlled bytes on the Vert.x event loop before application inspection. If a Java deserialization gadget chain exists on the classpath, this enables remote code execution; otherwise, denial of service is possible. TLS is disabled by default, facilitating man-in-the-middle exploitation.

Successful exploitation allows remote code execution on the client if a suitable Java deserialization gadget chain is present, or denial of service via crafted object graphs. The vulnerability is exploitable remotely without authentication. The default disabled TLS setting increases the risk of man-in-the-middle attacks enabling exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider enabling TLS to protect against man-in-the-middle attacks and avoid connecting to untrusted DRDA servers. Review application classpaths to minimize presence of known Java deserialization gadget chains.