CVE-2026-103223
8.2HighPublished 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-789
Impact
A malicious or man-in-the-middle PostgreSQL server can crash your client service via out-of-memory denial of service. The attacker needs network positioning to intercept or impersonate the database connection, and exploitation occurs before authentication finishes.
Root cause
The PostgreSQL wire protocol decoder accepts the 4-byte message length field without size validation, buffering incoming TCP data into memory without bound.
Affected systems
Eclipse Vert.x io.vertx:vertx-pg-client versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0
CVSS v4.0 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade io.vertx:vertx-pg-client to patched releases (such as 4.5.35, 5.0.13, 5.1.10, or 5.2.1 depending on your stream). If patching immediately is impossible, enforce strict TLS verification on the database connection to prevent man-in-the-middle manipulation.
$ ./mvnw dependency:tree -Dincludes=io.vertx:vertx-pg-clientAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes. The impacted component is io.vertx:vertx-pg-client.