CVE-2026-102465: Maven/io.vertx/vertx-mysql-client vulnerability
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Vert.x event loop thread, denying service to all connections and verticles sharing that loop.
The impacted component is io.vertx:vertx-mysql-client.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using io.vertx:vertx-mysql-client in versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, or 5.2.0 are listed as affected.
What access does an attacker need?
An attacker must be able to control or compromise the Redis server the client connects to, or be in a man-in-the-middle position able to alter RESP responses.
What is the expected impact on an application?
A crafted response can trigger a massive heap allocation and an OutOfMemoryError. This crashes the Vert.x event-loop thread and can deny service to all connections and verticles sharing that loop.
What response content triggers the failure?
The server response declares an extremely large RESP array, push, or attribute length. The parser pre-allocates an array using that declared length without an upper bound.