Will Your Eclipse Vert.x App Crash? Malicious PostgreSQL Servers Trigger Heap Exhaustion in Versions Up to 5.2.0

The short version

• Eclipse Vert.x clients using affected versions are vulnerable to denial-of-service attacks.
• The flaw resides in the binary array decoder within the vertx-pg-client module.
• Attackers exploit the lack of upper bounds on array dimension counts sent by servers.

The details

Eclipse Vert.x versions from 4.0.0 up to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contain a high-severity vulnerability rated CVSS 8.2. According to the NVD record, the issue lies in the DataTypeCodec.binaryDecodeArray function within the io.vertx:vertx-pg-client component. This function processes binary data arrays received from PostgreSQL servers.

The decoder allocates a Java array based on a 32-bit dimension count declared by the server. The code does not enforce an upper bound on this value. A malicious or compromised PostgreSQL server, or an on-path attacker intercepting an unencrypted connection, can send a crafted DataRow message. This message includes an excessively large array dimension value.

Consequently, the client attempts to allocate a multi-gigabyte heap segment. This action causes the application to crash with an OutOfMemoryError. The impact is a denial of service for any application relying on this specific client library to communicate with PostgreSQL databases.

The context

The vulnerability requires the client to connect to a hostile or intercepted database endpoint. It does not require authentication bypass or code execution on the server side. The threat model includes scenarios where an attacker controls the database server or can manipulate traffic on an insecure network path.

Organisations using older versions of Eclipse Vert.x for database connectivity are exposed. The affected range spans multiple major version lines, indicating the flaw persisted across several release cycles. Teams relying on these libraries for critical data pipelines should verify their current versions immediately.

Next steps

Security teams should inventory all applications using io.vertx:vertx-pg-client. Identify which versions fall within the affected ranges: 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0. Monitor vendor communications for a patched release. Until a fix is available, consider encrypting connections to prevent on-path manipulation.

What defenders should look for

Teams usually detect this activity through sudden application crashes or out-of-memory errors in Java heap logs. Check whether database clients are terminating unexpectedly after connecting to new or suspicious endpoints. Monitor for spikes in memory allocation requests from the vertx-pg-client component. First containment moves involve isolating affected services and restricting database connections to trusted, verified servers. Verify that network paths between clients and databases are encrypted to prevent interception. Review application logs for repeated connection failures or abrupt process terminations that correlate with database queries.

What to do and how to stay safe: Eclipse Vert.x

• Audit your software bill of materials for io.vertx:vertx-pg-client versions in the affected ranges.
• Ensure all connections between Vert.x clients and PostgreSQL servers use TLS encryption.
• Monitor application health checks for sudden memory exhaustion or process restarts.
• Once the vendor provides an update, test and deploy the patched version promptly.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE ID covers this Eclipse Vert.x vulnerability?

The vulnerability is tracked as CVE-2026-102463.

What is the CVSS score for this issue?

The Common Vulnerability Scoring System rate is 8.2, classified as high severity.

Which specific component is affected?

The io.vertx:vertx-pg-client component in Eclipse Vert.x is affected.