Eclipse Vert.x: Unbounded memory allocation in PostgreSQL client
Summary
The PostgreSQL message decoder in the Vert.x client library vertx-pg-client does not validate the message length field sent by the database server. A malicious, compromised or man-in-the-middle PostgreSQL server can send a manipulated length value, which makes the client buffer incoming data without limit until it runs out of memory and crashes. The attack occurs before authentication completes, so no credentials are needed, but the attacker must be the database server or sit on the network path to it. The impact is limited to availability; confidentiality and integrity are not affected.
Affected
- Eclipse Vert.x 4.0.0 to 4.5.34
- Eclipse Vert.x 5.0.0 to 5.0.12 (according to the CVE record; the GHSA advisory lists 5.0.0 to 5.1.8 only)
- Eclipse Vert.x 5.1.0 to 5.1.9 (according to the CVE record; the GHSA advisory lists up to 5.1.8)
- Eclipse Vert.x 5.2.0
Fixed in
- 4.5.35
- 5.1.10
- 5.2.1
- 5.0.x: Unknown. No fix confirmed in the advisory; confirm with Eclipse.
Workaround
- No vendor workaround known beyond the advisory.
- Enforce TLS with server certificate verification on PostgreSQL connections.
- Restrict which database hosts applications can reach and isolate database traffic on the internal network.
Exploitation
- No public exploit known (VulDB).
- Not listed as KEV (Strix).
- EPSS 0.00321 (Positive Technologies).
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Scan Java projects, containers and Quarkus-based applications for vertx-pg-client, including transitive dependencies.
- Upgrade to 4.5.35, 5.1.10 or 5.2.1, depending on the version in use.
- For 5.0.x deployments, confirm the fix status with Eclipse before relying on a patch.
- Until patched, enforce TLS with certificate verification and limit database reachability.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GHSA advisory (Eclipse Vert.x) github.com
- Eclipse CVE work item #354 gitlab.eclipse.org
- VulDB CVE entry vuldb.com
- Strix CVE entry www.strix.ai
- Positive Technologies via Vulners vulners.com
- OpenCVE record app.opencve.io
- Dependency bump evidence (hibernate-reactive PR 646) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:06.
Original description (NVD)
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-pg-client.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.