In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound… (CVE-2026-103224)

The vulnerability (CVE-2026-103224) affects the io.vertx:vertx-mysql-client component in Eclipse Vert.x versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0. The MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without enforcing a cumulative size limit. An attacker controlling or intercepting the MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition and causing unbounded direct-memory allocation on the client side. This leads to an out-of-memory crash before authentication completes, resulting in a denial of service.

This vulnerability can cause a denial of service (DoS) by forcing the client to allocate unbounded direct memory, leading to an out-of-memory crash. It does not impact confidentiality or integrity, but availability is severely affected. The attack can be executed by a malicious or compromised MySQL server or a man-in-the-middle attacker controlling the MySQL server communication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid connecting to untrusted or compromised MySQL servers. Monitor for unusual memory usage in clients using affected versions. No official fix or patch links are currently provided.