Eclipse Vert.x MSSQL client: Denial of service via unbounded TDS message reassembly
Summary
The TDS message decoder of the Vert.x MSSQL client (vertx-mssql-client), a Java library for Microsoft SQL Server, collects incoming TDS packets without a cumulative size limit. A malicious, compromised or man-in-the-middle SQL Server can send an endless stream of packets without the END_OF_MESSAGE flag, which exhausts direct memory and crashes the client application with an out-of-memory error. The attack occurs before authentication completes, so no credentials are needed, but the attacker must be the database server or sit on the network path to it.
Affected
- io.vertx:vertx-mssql-client (Maven)
- Eclipse Vert.x 4.0.0 to 4.5.34
- Eclipse Vert.x 5.0.0 to 5.0.12 (fix status unresolved, see recommendation)
- Eclipse Vert.x 5.1.0 to 5.1.9 (vendor advisory lists up to 5.1.8)
- Eclipse Vert.x 5.2.0
Fixed in
- Eclipse Vert.x 4.5.35
- Eclipse Vert.x 5.1.10
- Eclipse Vert.x 5.2.1
- Eclipse Vert.x 5.0.x: no fixed release listed in the vendor advisory. Unknown.
Workaround
- No vendor workaround known.
- Restrict which SQL Server endpoints the application can reach.
- Enforce TLS to the database to make man-in-the-middle attacks harder.
- Set container or JVM direct-memory limits so that an out-of-memory condition is contained.
Exploitation
- No evidence of exploitation in the wild was found.
- No public proof of concept was found; the search was not exhaustive.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
Our recommendation
- Inventory applications that use vertx-mssql-client and their versions.
- Upgrade to 4.5.35, 5.1.10 or 5.2.1 where the application allows.
- For 5.0.x, confirm the fix status with Eclipse before assuming it is safe.
- Apply the workarounds until the upgrade is done.
- Monitor application memory and restarts for signs of abuse.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-fg6c-83v6-vhq4 github.com
- Eclipse CVE assignment ticket #346 gitlab.eclipse.org
- Vert.x 4.5.35 release notes vertx.io
- Vert.x 5.2.1 release notes vertx.io
- VulDB entry CVE-2026-102462 vuldb.com
- Vulners CIRCL GHSA-FG6C-83V6-VHQ4 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:04.
Original description (NVD)
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-mssql-client.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.