CVE-2026-102464
Received Received - Intake

Memory Exhaustion in Eclipse Vert.x MQTT Client

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet to complete the QoS 2 handshake. This map has no size limit; the maxInflightQueue option is enforced only on the outbound publish path and does not constrain inbound message retention. A malicious or compromised MQTT broker can exploit this by sending QoS 2 PUBLISH messages with distinct packet identifiers and withholding the PUBREL responses. Each incomplete handshake causes the client to retain the full publish message (topic, payload, and metadata) indefinitely, leading to unbounded memory growth in the Vert.x process. This can degrade the MQTT-consuming application or cause out-of-memory termination. The impacted component is io.vertx:vertx-mqtt.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-102464
EUVD
EUVD-2026-101936

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Eclipse Foundation Eclipse Vert.x 4.0.0
Eclipse Foundation Eclipse Vert.x 5.0.0
Eclipse Foundation Eclipse Vert.x 5.1.0
Eclipse Foundation Eclipse Vert.x 5.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Eclipse Vert.x MQTT client (vertx-mqtt) in specific versions. It allows a malicious MQTT broker to send QoS 2 PUBLISH messages with unique identifiers and withhold PUBREL responses. The client stores these messages indefinitely in an unbounded internal map while waiting for PUBREL, causing unbounded memory growth that can crash the application.

Detection Guidance

Monitor memory usage of the Vert.x process hosting the MQTT client. Look for unbounded growth in heap memory when connected to an MQTT broker. Check for excessive retained QoS 2 PUBLISH messages in logs or via JVM tools like jmap or VisualVM.

Impact Analysis

The impact includes application degradation or out-of-memory termination due to unbounded memory consumption. This can disrupt services relying on the MQTT client, leading to downtime or data loss if the application crashes.

Mitigation Strategies

Upgrade to patched versions: 4.5.35, 5.1.10, 5.2.1, or later. If upgrading is not possible, limit inbound QoS 2 messages by reducing client-side timeouts or disabling QoS 2 support until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102464. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart