CVE-2026-102466
Undergoing Analysis Undergoing Analysis - In Progress

Vert.x MySQL Client Heap Exhaustion via Malicious Column Count

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a server-declared column count with no upper-bound validation. A malicious or compromised MySQL server, or an attacker with man-in-the-middle positioning, can send a crafted result set packet with an extremely large column count, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Netty event loop thread, causing a complete denial of service for all connections and verticles in the Vert.x application. The impacted component is io.vertx:vertx-mysql-client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-102466
EUVD
EUVD-2026-101957

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Eclipse Foundation Eclipse Vert.x 4.0.0
Eclipse Foundation Eclipse Vert.x 5.0.0
Eclipse Foundation Eclipse Vert.x 5.1.0
Eclipse Foundation Eclipse Vert.x 5.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Eclipse Vert.x MySQL client (vertx-mysql-client) in versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0. The client pre-allocates an array for column definitions based on a server-declared column count without validating an upper bound. A malicious or compromised MySQL server, or an attacker with man-in-the-middle access, can send a result set packet with an extremely large column count. This forces the client to attempt a massive heap allocation, leading to an OutOfMemoryError that crashes the Netty event loop thread, causing a complete denial of service for all connections and verticles in the Vert.x application.

The impacted component is io.vertx:vertx-mysql-client.

Detection Guidance

Monitor for crashes in Vert.x applications using the MySQL client, particularly OutOfMemoryError logs in Netty event loop threads. Check for unusually large column counts in MySQL result sets by inspecting network traffic or server responses.

Impact Analysis

This vulnerability can cause a complete denial of service for your Vert.x application. If exploited, it crashes the Netty event loop thread due to an OutOfMemoryError, halting all connections and verticles. This means your application will become unresponsive and unavailable to users.

Compliance Impact

This vulnerability causes a complete denial of service in the Vert.x application by crashing the Netty event loop thread due to an OutOfMemoryError. This could lead to prolonged unavailability of systems handling sensitive data, potentially violating compliance requirements for availability in standards like GDPR (data processing integrity) and HIPAA (service continuity).

Mitigation Strategies

Upgrade the vertx-mysql-client to patched versions (5.2.1, 5.1.10, or 4.5.35). If upgrading is not possible, restrict network access to MySQL servers or use trusted connections to prevent man-in-the-middle attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102466. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart