CVE-2026-103223: Maven/io.vertx/vertx-pg-client vulnerability
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAXVALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes.
The impacted component is io.vertx:vertx-pg-client.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using the io.vertx:vertx-pg-client component are exposed when they use affected Eclipse Vert.x versions and connect to a malicious, compromised, or man-in-the-middle PostgreSQL server.
Does an attacker need valid PostgreSQL credentials?
No. The condition occurs before authentication completes, so a malicious server or an attacker able to intercept the PostgreSQL connection can trigger it without completing authentication.
How can I determine whether an application is affected?
Check whether the application includes io.vertx:vertx-pg-client through Eclipse Vert.x versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, or 5.2.0.