Eclipse Vert.x DB2 client: Unsafe Java deserialization of UDT column data
Summary
The Vert.x DB2 client (io.vertx:vertx-db2-client) deserializes User Defined Type (UDT) column data with Java ObjectInputStream.readObject() and no class filter. A malicious or man-in-the-middle DRDA server can send a crafted column tagged with FDOCA LID 0x50, causing the client to deserialize attacker-controlled bytes. If a Java deserialization gadget chain is on the application classpath, this can lead to remote code execution. Without a gadget chain, the attacker can cause a denial of service. TLS is disabled by default, which makes man-in-the-middle attacks feasible.
Affected
- Eclipse Vert.x 4.0.0 to 4.5.34
- Eclipse Vert.x 5.0.0 to 5.0.12
- Eclipse Vert.x 5.1.0 to 5.1.9
- Eclipse Vert.x 5.2.0
- Component: io.vertx:vertx-db2-client
Fixed in
- 4.5.35
- 5.1.10 (5.1.9 should not be used because of a release-process error)
- 5.2.1
- 5.0.x: Unknown. No fixed version has been published for this line.
Workaround
- None from the vendor. The fix is an upgrade.
- Enable TLS on DB2 connections to remove the on-path attacker. This does not fix the code.
- Remove the vertx-db2-client dependency if the DB2 client is not used.
Exploitation
- No known exploitation in the wild. Not verified against the CISA KEV catalogue.
- No public exploit known (VulDB).
- Low EPSS score (0.00458).
- Exploitation requires network position (man-in-the-middle) or control of the DB2 server. No credentials are needed.
Our recommendation
- Inventory Maven and Gradle builds for vertx-db2-client, directly or transitively, including frameworks that depend on it.
- Upgrade to 4.5.35, 5.1.10 or 5.2.1, depending on the branch in use. Confirm a fix for 5.0.x with Eclipse before relying on it, or move to a supported line.
- Enable TLS on DB2 connections and restrict network paths between application servers and DB2 servers.
- Check the classpath for Java deserialization gadget libraries.
- Review the GHSA rating: the CNA CVSS v4 score is 9.2 (Critical), while the GHSA rates it High (8.1, CVSS v3.1).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-j4vf-w939-pgxf github.com
- Eclipse CVE assignment work item #347 gitlab.eclipse.org
- Eclipse Vert.x 4.5.35 release notes vertx.io
- Eclipse Vert.x 5.1.10 release notes vertx.io
- Hibernate Reactive pull request 646 github.com
- VulDB CVE-2026-102469 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:23.
Original description (NVD)
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist. This code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). However, DB2 does not support this type of UDT. The FDOCA 0x50 type is never sent by a legitimate DB2 server. Nevertheless, a malicious or man-in-the-middle DRDA server could craft a response with a 0x50-tagged column, causing the client to deserialize arbitrary attacker-controlled bytes on the Vert.x event loop before any application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this enables remote code execution. Without a gadget chain, denial of service is possible via crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible. The impacted component is io.vertx:vertx-db2-client.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.