Eclipse Vert.x MQTT Client Vulnerability in Message Retention

CVE-2026-102464

What is CVE-2026-102464?

In specific versions of the Eclipse Vert.x MQTT component, an internal mechanism for managing in-flight QoS 2 PUBLISH messages does not enforce limits on message retention. This can lead to an accumulation of unprocessed messages when a malicious broker sends multiple distinct QoS 2 PUBLISH messages without responding with PUBREL. The excessive retention can cause significant memory growth, potentially impacting the performance of applications utilizing the Vert.x process, and in severe cases, lead to application crashes due to out-of-memory errors.

References