Denial of Service Vulnerability in Eclipse Vert.x MySQL Client

CVE-2026-102466

What is CVE-2026-102466?

The Eclipse Vert.x MySQL client pre-allocates an array for column definitions based on server-declared column counts without proper upper-bound validation. This allows a malicious MySQL server or an attacker positioned as a man-in-the-middle to exploit the vulnerability by sending a specially crafted result set packet that contains an excessive column count. Such exploitation could lead to massive heap allocation requests, potentially resulting in an OutOfMemoryError that crashes the Netty event loop thread. Consequently, this causes a total denial of service for all connections and verticles within the affected Vert.x application.

References