CVE-2026-102463: Maven/io.vertx/vertx-pg-client vulnerability
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL server, or an on-path attacker intercepting an unencrypted connection, can send a crafted DataRow message with an excessively large array dimension value, causing the client to attempt a multi-gigabyte heap allocation and crash with an OutOfMemoryError.
The impacted component is io.vertx:vertx-pg-client.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Applications using io.vertx:vertx-pg-client in the affected version ranges are exposed when they connect to a malicious or compromised PostgreSQL server. Connections that are not encrypted can also be exposed to an on-path attacker able to intercept and modify server responses.
What does an attacker need to do to trigger the failure?
The attacker must cause the client to process a crafted PostgreSQL DataRow message containing an excessively large 32-bit array dimension value. This makes the binary array decoder attempt a multi-gigabyte Java heap allocation, which can terminate the application with an OutOfMemoryError.
How can I determine whether my application is affected?
Check whether the application includes the Maven component io.vertx:vertx-pg-client and identify its resolved version. The affected ranges are 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0.