In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains… (CVE-2026-102469)

The Vert.x DB2 client (io.vertx:vertx-db2-client) in Eclipse Vert.x versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contains DRDA protocol handling code that unsafely deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call without any ObjectInputFilter or class allowlist. This deserialization is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50), a type not supported by legitimate DB2 servers. A malicious or man-in-the-middle DRDA server can craft a response with this 0x50-tagged column, causing the client to deserialize attacker-controlled bytes on the Vert.x event loop before application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this can lead to remote code execution. Without such a gadget chain, denial of service is possible through crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible. The vulnerability is identified as CVE-2026-102469 with a CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

This vulnerability allows a malicious or man-in-the-middle DRDA server to cause the Vert.x DB2 client to deserialize attacker-controlled data, potentially leading to remote code execution if a suitable Java deserialization gadget chain is present on the application's classpath. In the absence of such a gadget chain, denial of service is possible. The default disabled state of TLS increases the risk of man-in-the-middle exploitation. There is no impact on confidentiality or integrity directly indicated, but availability can be affected due to denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to enable TLS to protect against man-in-the-middle attacks and avoid connecting to untrusted DRDA servers. Additionally, review and restrict the application's classpath to prevent inclusion of known Java deserialization gadget chains. Monitor vendor communications for official patches or updates addressing this vulnerability.