Deserialization Vulnerability in Eclipse Vert.x DB2 Client

CVE-2026-102469

What is CVE-2026-102469?

A deserialization vulnerability in the Eclipse Vert.x DB2 client occurs due to inadequate security controls when processing User Defined Type (UDT) column data from DRDA servers. This vulnerability can be exploited by a malicious or man-in-the-middle DRDA server to craft responses containing 0x50-tagged UDT columns, leading to the deserialization of arbitrary bytes. If a suitable Java deserialization gadget chain exists, this may allow remote code execution; otherwise, it could result in a denial of service attack. The default configuration does not enable TLS, making such exploits more feasible.

References