PostgreSQL Message Decoding Flaw in Eclipse Vert.x by Eclipse Foundation

CVE-2026-103223

What is CVE-2026-103223?

A vulnerability exists in certain versions of Eclipse Vert.x related to the PostgreSQL message decoder. The issue arises when the decoder processes the length field of messages without sufficient validation, allowing a compromised PostgreSQL server to send an excessively large message length. This can result in unbounded memory allocation on the client side, potentially leading to an out-of-memory crash, which occurs prior to authentication completion. Such a vulnerability can be exploited by attackers in various scenarios, making it crucial for users to apply the latest patches.

References