In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte… (CVE-2026-103223)

The vulnerability in Eclipse Vert.x's PostgreSQL client (io.vertx:vertx-pg-client) involves improper validation of the 4-byte message length field in the PostgreSQL wire protocol. The decoder accepts a length field up to Integer.MAX_VALUE without any maximum size check. A malicious or compromised PostgreSQL server or man-in-the-middle attacker can exploit this by sending a message header with a very large length value, causing the client to allocate memory without bounds. This leads to unbounded memory consumption and can cause the client application to crash due to out-of-memory errors. The issue affects multiple version ranges of Eclipse Vert.x as specified.

The vulnerability can cause a denial of service on the client side by exhausting memory resources, leading to an out-of-memory crash. There is no impact on confidentiality or integrity as per the CVSS vector. The attack can be triggered before authentication, meaning it can be exploited without valid credentials if the client connects to a malicious or compromised PostgreSQL server or if a man-in-the-middle attack is possible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid connecting to untrusted PostgreSQL servers and ensure network protections against man-in-the-middle attacks are in place. Monitor for vendor updates and apply official patches once released.