Eclipse Vert.x: Denial of service in PostgreSQL client array decoding
Summary
Eclipse Vert.x includes the vertx-pg-client module, a PostgreSQL client library. Its binary array decoder allocates a Java array based on a 32-bit dimension count sent by the database server, without an upper limit. A malicious or compromised PostgreSQL server, or an on-path attacker on an unencrypted connection, can send a crafted DataRow message that triggers a multi-gigabyte allocation and an OutOfMemoryError, crashing the client. The impact is limited to availability, and a crash can also interrupt other connections on the same event loop.
Affected
- Eclipse Vert.x 4.0.0 to 4.5.34
- Eclipse Vert.x 5.0.0 to 5.0.12
- Eclipse Vert.x 5.1.0 to 5.1.9 (the advisory lists up to 5.1.8; 5.1.9 is treated as affected)
- Eclipse Vert.x 5.2.0
- Component: io.vertx:vertx-pg-client
- Transitive dependencies also count, so check dependency trees.
Fixed in
- Eclipse Vert.x 4.5.35
- Eclipse Vert.x 5.1.10
- Eclipse Vert.x 5.2.1
- Eclipse Vert.x 5.0.x: Unknown. No fixed 5.0.x release was found in the sources; move to 5.1.10 or later if compatible.
Workaround
- No vendor workaround is listed. Upgrading is the fix.
- Require TLS for database connections.
- Connect only to trusted database servers.
Exploitation
- No public exploit or proof of concept found.
- No in-the-wild exploitation found. CISA SSVC lists exploitation as none.
- VulDB reports no available exploit.
- The CISA KEV catalogue was not checked directly.
Our recommendation
- Check whether applications use vertx-pg-client, including transitive dependencies.
- Upgrade to 4.5.35, 5.1.10 or 5.2.1. For 5.0.x, plan a move to 5.1.10 or later.
- Require TLS for PostgreSQL connections and restrict connections to trusted database servers.
- Monitor for service restarts and OutOfMemoryError messages.
- Priority: medium for applications that connect over networks you do not control, low for internal setups with TLS and trusted hosts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-xqmh-8fhj-48fp github.com
- Eclipse CVE assignment work item #345 gitlab.eclipse.org
- Fix pull request #1726 (vertx-sql-client) github.com
- VulDB CVE-2026-102463 vuldb.com
- OpenCVE CVE-2026-102463 app.opencve.io
- Vulners NVD mirror CVE-2026-102463 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:04.
Original description (NVD)
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL server, or an on-path attacker intercepting an unencrypted connection, can send a crafted DataRow message with an excessively large array dimension value, causing the client to attempt a multi-gigabyte heap allocation and crash with an OutOfMemoryError. The impacted component is io.vertx:vertx-pg-client.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.