Eclipse Vert.x MQTT: Unbounded memory growth via inbound QoS 2 messages
Summary
The MQTT client in Eclipse Vert.x (module io.vertx:vertx-mqtt) keeps every inbound QoS 2 PUBLISH message in an internal map until the matching PUBREL arrives, and this map has no size limit. A malicious or compromised MQTT broker can send QoS 2 messages with distinct packet identifiers and withhold the PUBREL packets, causing unbounded memory growth. This can degrade the affected application or lead to an out-of-memory termination, resulting in a denial of service.
Affected
- io.vertx:vertx-mqtt 4.0.0 to 4.5.34
- io.vertx:vertx-mqtt 5.0.0 to 5.1.9 (vendor advisory: 5.0.0 to 5.1.8)
- io.vertx:vertx-mqtt 5.2.0
Fixed in
- 4.5.35
- 5.1.10
- 5.2.1
Workaround
Unknown. The vendor advisory names no workaround; upgrading is the fix.
- Third-party sources suggest restricting the brokers the application may connect to and monitoring heap usage of affected services (not vendor-sourced).
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- No public proof-of-concept exploit known.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Identify Java applications and IoT or building-automation integrations that embed vertx-mqtt, including vendor-supplied software.
- Upgrade to 4.5.35, 5.1.10 or 5.2.1 as part of the normal patch cycle; prioritise services connecting to third-party or cloud brokers.
- Restrict broker connections to trusted endpoints and monitor memory usage of affected services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-46xj-5735-6qrp github.com
- Eclipse CVE assignment work item #344 gitlab.eclipse.org
- VulDB entry CVE-2026-102464 vuldb.com
- VulDB exploit information 420543 vuldb.com
- Vulners NVD record CVE-2026-102464 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:05.
Original description (NVD)
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet to complete the QoS 2 handshake. This map has no size limit; the maxInflightQueue option is enforced only on the outbound publish path and does not constrain inbound message retention. A malicious or compromised MQTT broker can exploit this by sending QoS 2 PUBLISH messages with distinct packet identifiers and withholding the PUBREL responses. Each incomplete handshake causes the client to retain the full publish message (topic, payload, and metadata) indefinitely, leading to unbounded memory growth in the Vert.x process. This can degrade the MQTT-consuming application or cause out-of-memory termination. The impacted component is io.vertx:vertx-mqtt.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.