CVE-2026-103223
Undergoing Analysis Undergoing Analysis - In Progress

Vert.x PostgreSQL Client Memory Exhaustion Vulnerability

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-pg-client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-103223
EUVD
EUVD-2026-101956

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Eclipse Foundation Eclipse Vert.x 4.0.0
Eclipse Foundation Eclipse Vert.x 5.0.0
Eclipse Foundation Eclipse Vert.x 5.1.0
Eclipse Foundation Eclipse Vert.x 5.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Denial of Service (DoS) vulnerability in Eclipse Vert.x's PostgreSQL client (vertx-pg-client). It affects versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0. The issue occurs because the PostgreSQL message decoder reads the 4-byte message length field without validating its maximum value. An attacker can send a message header with an extremely large length value, causing the client to allocate unbounded memory and crash due to an out-of-memory error before authentication completes.

The vulnerability is exploitable by a malicious, compromised, or man-in-the-middle PostgreSQL server.

Detection Guidance

Monitor for out-of-memory crashes in applications using Eclipse Vert.x PostgreSQL client versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, or 5.2.0. Check logs for excessive memory usage or TCP buffer accumulation during PostgreSQL client-server communication.

Impact Analysis

This vulnerability can cause your application to crash due to excessive memory consumption, leading to a Denial of Service (DoS). It may disrupt services relying on the Vert.x PostgreSQL client, especially if the application connects to untrusted or compromised PostgreSQL servers.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling a denial-of-service attack that disrupts system availability. GDPR requires data processing systems to ensure availability and resilience, while HIPAA mandates safeguards against unauthorized disruptions. An out-of-memory crash from unbounded memory allocation could lead to service unavailability, potentially violating these requirements.

Mitigation Strategies
  • Upgrade to patched versions: 4.5.35, 5.1.10, 5.2.1, or later.
  • Restrict network access to PostgreSQL servers to trusted sources only.
  • Implement network-level monitoring for anomalous message lengths in PostgreSQL traffic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103223. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart