Unbounded Memory Allocation in Eclipse Vert.x MSSQL Client Affects Multiple Versions

CVE-2026-102462

What is CVE-2026-102462?

The Eclipse Vert.x MSSQL client is vulnerable due to improper handling of TDS packets. Specifically, the TDS message decoder aggregates incoming packets into a composite direct-memory buffer without a defined size limit. An attacker or compromised SQL Server can exploit this flaw by sending a continuous influx of TDS packets that fail to signal the END_OF_MESSAGE, leading to unbounded memory allocation on the client side. This vulnerability can result in an out-of-memory crash, creating potential disruptions, especially before user authentication is complete.

References