CVE-2026-103224

Undergoing Analysis Undergoing Analysis - In Progress

Memory Exhaustion in Eclipse Vert.x MySQL Client

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: Eclipse Foundation

Description

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-mysql-client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103224

EUVD

EUVD-2026-101955

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse	Foundation	Eclipse Vert.x 4.0.0
Eclipse	Foundation	Eclipse Vert.x 5.0.0
Eclipse	Foundation	Eclipse Vert.x 5.1.0
Eclipse	Foundation	Eclipse Vert.x 5.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

This is a Denial of Service (DoS) vulnerability in the Vert.x MySQL Client (vertx-mysql-client) affecting versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0. The MySQL message decoder aggregates inbound multi-packet payloads into a direct-memory buffer without a size limit. A malicious MySQL server can send continuous maximum-length packets (0xFFFFFF), preventing the end-of-message condition and causing unbounded memory allocation. This leads to an out-of-memory crash before authentication completes.

Detection Guidance

Monitor for abnormal memory usage spikes in Java processes using the Vert.x MySQL Client. Check for continuous network traffic from MySQL servers to clients running vulnerable versions. Use tools like netstat or ss to inspect connections to MySQL ports. Logs may show out-of-memory errors before authentication completes.

Impact Analysis

The vulnerability can cause your application to crash due to excessive memory consumption, leading to service disruption. Since it occurs before authentication, attackers can exploit it without needing valid credentials. The impact includes downtime, degraded performance, or complete unavailability of services relying on the Vert.x MySQL Client.

Compliance Impact

This DoS vulnerability could lead to service unavailability, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule). Downtime may result in unauthorized access to data or failure to provide timely access to personal health information, risking compliance penalties or breaches.

Mitigation Strategies

Upgrade io.vertx:vertx-mysql-client to patched versions 5.2.1, 5.1.10, or 4.5.35 immediately.
Restrict network access to MySQL clients running vulnerable versions until patched.
Monitor for signs of exploitation such as unusual memory consumption or network traffic patterns.

Hi! I’m here to help you understand CVE-2026-103224. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70