CVE-2026-102462: Maven/io.vertx/vertx-mssql-client vulnerability
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the ENDOFMESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes.
The impacted component is io.vertx:vertx-mssql-client.
Affected Software
Event History
Frequently Asked Questions
How can I determine whether an application is affected?
Check whether it includes io.vertx:vertx-mssql-client at a version in 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, or 5.2.0.
What attacker position is required to trigger the issue?
The application must connect to a malicious or compromised SQL Server, or an attacker must be able to act as a man-in-the-middle for the SQL Server connection. The attacker can send a continuous TDS packet stream that does not mark the end of a message.
Are SQL Server credentials required for exploitation?
No completed authentication is required. The condition occurs before authentication completes, so exposure exists during connection establishment to an untrusted, compromised, or intercepted server.