CVE-2026-103223: Vulnerability in Eclipse Foundation Eclipse Vert.x
Description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-pg-client.
CVSS v4.0
Score 8.2high
Affected software
Eclipse Foundation
Eclipse Vert.x
pkg:maven/io.vertx/vertx-pg-clientRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-103223 affects the io.vertx:vertx-pg-client component of Eclipse Vert.x. The PostgreSQL message decoder does not validate the maximum size of the 4-byte message length field in the wire protocol. This allows a malicious or man-in-the-middle PostgreSQL server to send a message header with a length field set to a very large value (up to Integer.MAX_VALUE). The decoder then accumulates TCP data into a composite buffer without limit, leading to unbounded memory allocation and an out-of-memory crash on the client side. This vulnerability is present in Eclipse Vert.x versions >=4.0.0 <=4.5.34, >=5.0.0 <=5.0.12, >=5.1.0 <=5.1.9, and =5.2.0.
Potential Impact
An attacker controlling or intercepting the PostgreSQL server connection can cause the Eclipse Vert.x client to allocate excessive memory, resulting in an out-of-memory crash. This denial of service occurs before authentication completes, potentially disrupting client operations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid connecting to untrusted PostgreSQL servers or intercepting network traffic. Monitor for updates from the Eclipse Foundation regarding patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-09-30T07:25:48.666Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad090022cdf04f656196489
Added to database: 10/15/2026, 08:34:10 UTC
Last enriched: 10/15/2026, 08:48:22 UTC
Last updated: 10/15/2026, 19:00:27 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.