Vert.x PostgreSQL Client Memory Exhaustion Vulnerability

Executive Summary

This is a Denial of Service (DoS) vulnerability in Eclipse Vert.x's PostgreSQL client (vertx-pg-client). It affects versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0. The issue occurs because the PostgreSQL message decoder reads the 4-byte message length field without validating its maximum value. An attacker can send a message header with an extremely large length value, causing the client to allocate unbounded memory and crash due to an out-of-memory error before authentication completes.

The vulnerability is exploitable by a malicious, compromised, or man-in-the-middle PostgreSQL server.

Useful 0 Not Useful 0

Detection Guidance

Monitor for out-of-memory crashes in applications using Eclipse Vert.x PostgreSQL client versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, or 5.2.0. Check logs for excessive memory usage or TCP buffer accumulation during PostgreSQL client-server communication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause your application to crash due to excessive memory consumption, leading to a Denial of Service (DoS). It may disrupt services relying on the Vert.x PostgreSQL client, especially if the application connects to untrusted or compromised PostgreSQL servers.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade to patched versions: 4.5.35, 5.1.10, 5.2.1, or later.
• Restrict network access to PostgreSQL servers to trusted sources only.
• Implement network-level monitoring for anomalous message lengths in PostgreSQL traffic.

Useful 0 Not Useful 0