CVE-2026-102462
Received Received - Intake

Memory Exhaustion in Eclipse Vert.x MSSQL Client

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-mssql-client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-102462
EUVD
EUVD-2026-101961

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Eclipse Foundation Eclipse Vert.x 4.0.0
Eclipse Foundation Eclipse Vert.x 5.0.0
Eclipse Foundation Eclipse Vert.x 5.1.0
Eclipse Foundation Eclipse Vert.x 5.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Eclipse Vert.x MSSQL client (vertx-mssql-client) in specific versions. The TDS message decoder aggregates inbound TDS packets into a direct-memory buffer without a size limit. A malicious or compromised SQL Server can send a continuous stream of TDS packets without the END_OF_MESSAGE flag, causing unbounded memory allocation and leading to an out-of-memory crash on the client side before authentication completes.

Detection Guidance

Monitor for abnormal memory usage or crashes in applications using the Vert.x MSSQL client. Check for continuous TDS packet streams without END_OF_MESSAGE flags in network traffic logs. Use tools like Wireshark to inspect SQL Server communication for malformed or excessive TDS packets.

Impact Analysis

This vulnerability can cause a denial of service by crashing the client application due to excessive memory consumption. It may lead to service unavailability and potential downtime for applications using the affected Vert.x MSSQL client versions. The attack can be executed remotely without requiring privileges or user interaction.

Mitigation Strategies

Upgrade the Vert.x MSSQL client to patched versions (5.2.1, 5.1.10, or 4.5.35). If upgrading is not possible, restrict network access to the SQL Server or use firewalls to limit exposure. Monitor for suspicious network activity targeting the MSSQL client.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102462. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart