CVE-2026-103224
Received Received - Intake

Memory Exhaustion in Eclipse Vert.x MySQL Client

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle MySQL server can send a continuous stream of packets with the maximum payload length (0xFFFFFF), preventing the end-of-message condition from being reached, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-mysql-client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-103224
EUVD
EUVD-2026-101955

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Eclipse Foundation Eclipse Vert.x 4.0.0
Eclipse Foundation Eclipse Vert.x 5.0.0
Eclipse Foundation Eclipse Vert.x 5.1.0
Eclipse Foundation Eclipse Vert.x 5.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Denial of Service (DoS) vulnerability in the Vert.x MySQL Client (vertx-mysql-client) affecting versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0. The MySQL message decoder aggregates inbound multi-packet payloads into a direct-memory buffer without a size limit. A malicious MySQL server can send continuous maximum-length packets (0xFFFFFF), preventing the end-of-message condition and causing unbounded memory allocation. This leads to an out-of-memory crash before authentication completes.

Detection Guidance

Monitor for abnormal memory usage spikes in Java processes using the Vert.x MySQL Client. Check for continuous network traffic from MySQL servers to clients running vulnerable versions. Use tools like netstat or ss to inspect connections to MySQL ports. Logs may show out-of-memory errors before authentication completes.

Impact Analysis

The vulnerability can cause your application to crash due to excessive memory consumption, leading to service disruption. Since it occurs before authentication, attackers can exploit it without needing valid credentials. The impact includes downtime, degraded performance, or complete unavailability of services relying on the Vert.x MySQL Client.

Compliance Impact

This DoS vulnerability could lead to service unavailability, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule). Downtime may result in unauthorized access to data or failure to provide timely access to personal health information, risking compliance penalties or breaches.

Mitigation Strategies
  • Upgrade io.vertx:vertx-mysql-client to patched versions 5.2.1, 5.1.10, or 4.5.35 immediately.
  • Restrict network access to MySQL clients running vulnerable versions until patched.
  • Monitor for signs of exploitation such as unusual memory consumption or network traffic patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103224. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart