Unbounded Memory Allocation Vulnerability in Eclipse Vert.x MySQL Client

CVE-2026-103224

What is CVE-2026-103224?

In Eclipse Vert.x versions 4.0.0 to 4.5.34 and 5.0.0 to 5.2.0, a flaw is present in the MySQL message decoder of the vertx-mysql-client. This vulnerability allows a malicious server to send endless packets without a limit on the cumulative payload size. As a result, the decoder aggregates these packets into a direct-memory buffer, which can cause unbounded memory allocation on the client side, potentially leading to an out-of-memory crash. This issue can be exploited before the authentication process is completed, making it particularly concerning for users.

References