Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Eclipse Vert.x can cause PostgreSQL client to run out of memory

CVE-2026-103223 · published 20 days ago
Summary

Certain versions of Eclipse Vert.x read the size of incoming PostgreSQL messages without checking whether the size is reasonable. A malicious or compromised PostgreSQL server can reply with an extremely large size, causing the client to keep using more and more memory until it crashes. Update to a newer Vert.x release or avoid connecting to untrusted PostgreSQL servers to prevent this problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
eclipse foundation eclipse vert.x <= 4.5.34
eclipse vert.x >= 4.5.0, < 4.5.35
>= 5.0.0, < 5.1.10
5.2.0
cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*
Original advisory text
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protoc...
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes.



The impacted component is io.vertx:vertx-pg-client.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-789Memory Allocation with Excessive Size Value
Timeline
Published15 Oct 2026
Updated4 Nov 2026
First seen15 Oct 2026
Sources
CVE-2026-103223 · NVD
CVE-2026-103223 · MITRE
CVE-2026-103223 · OSV
GHSA-hm2j-xp3c-jff2 · GHSA
Track software like this
Free during beta