CVE-2026-102464: Maven/io.vertx/vertx-mqtt vulnerability
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet to complete the QoS 2 handshake. This map has no size limit; the maxInflightQueue option is enforced only on the outbound publish path and does not constrain inbound message retention.
A malicious or compromised MQTT broker can exploit this by sending QoS 2 PUBLISH messages with distinct packet identifiers and withholding the PUBREL responses. Each incomplete handshake causes the client to retain the full publish message (topic, payload, and metadata) indefinitely, leading to unbounded memory growth in the Vert.x process. This can degrade the MQTT-consuming application or cause out-of-memory termination.
The impacted component is io.vertx:vertx-mqtt.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Applications using io.vertx:vertx-mqtt in the affected version ranges are exposed when they connect to a malicious or compromised MQTT broker. The issue affects the MQTT client component and can cause memory exhaustion in the Vert.x process.
What does an attacker need to do to trigger the memory growth?
The broker must send QoS 2 PUBLISH messages with distinct packet identifiers and withhold the corresponding PUBREL packets. Each incomplete QoS 2 handshake leaves the full inbound publish message retained in the client's internal map.
Does maxInflightQueue limit this inbound memory usage?
No. maxInflightQueue is enforced only for outbound publishing and does not limit inbound QoS 2 message retention.
How can I tell whether a client is being affected?
Look for sustained or unbounded memory growth in a Vert.x application consuming MQTT messages, particularly when QoS 2 PUBLISH messages are received without their corresponding PUBREL packets. Retained entries in the client's qos2inbound map indicate incomplete inbound QoS 2 handshakes.