CVE-2026-102462
8.2HighPublished 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-400
Impact
A rogue, compromised, or man-in-the-middle SQL Server can crash the client service with an out-of-memory error before authentication even finishes. To exploit this, the attacker needs to intercept or serve TDS connections made by the client.
Root cause
The TDS message decoder accumulates inbound packets into a direct-memory buffer without enforcing an aggregate size limit if the END_OF_MESSAGE flag is never sent.
Affected systems
Eclipse Vert.x vertx-mssql-client (io.vertx:vertx-mssql-client) versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0.
CVSS v4.0 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade io.vertx:vertx-mssql-client past the affected version streams once patches release (or check vendor advisory links for patched releases). If immediate upgrades aren't available, secure and isolate database network channels using verified TLS to prevent server spoofing and man-in-the-middle attacks.
$ mvn dependency:tree -Dincludes=io.vertx:vertx-mssql-clientAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-mssql-client.