CVE-2026-103224: Vulnerability in Eclipse Foundation Eclipse Vert.x

In Eclipse Vert.x versions >=4.0.0 <=4.5.34, >=5.0.0 <=5.0.12, >=5.1.0 <=5.1.9, and =5.2.0, the MySQL message decoder in the io.vertx:vertx-mysql-client component aggregates inbound multi-packet payloads into a composite direct-memory buffer without enforcing any cumulative size limit. A malicious or compromised MySQL server can exploit this by sending a continuous stream of maximum-length packets (0xFFFFFF), preventing the end-of-message condition and causing unbounded direct-memory allocation on the client side. This leads to an out-of-memory crash before authentication completes, resulting in denial of service.

The vulnerability allows a malicious or compromised MySQL server, or a man-in-the-middle attacker, to cause the Eclipse Vert.x MySQL client to allocate unbounded direct memory, resulting in an out-of-memory crash. This denial-of-service condition occurs before authentication, potentially disrupting application availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid connecting Eclipse Vert.x MySQL clients to untrusted or potentially compromised MySQL servers. Monitor for updates from the Eclipse Foundation regarding patches or mitigations.