Threats Tagged 'ghsa-xrjr-rf8w-fphg'

Eclipse Vert.x versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and version 5.2.0 contain a vulnerability in the vertx-mssql-client component. The TDS message decoder aggregates inbound TDS packets into a composite direct-memory buffer without a cumulative size limit. A malicious or compromised SQL Server can exploit this by sending continuous TDS packets without the END_OF_MESSAGE flag, causing unbounded memory allocation and an out-of-memory crash before authentication completes.