Vert.x MSSQL Client CVE-2026-102462: Unauthenticated TDS Decoding Triggers OOM Crashes

Eclipse Vert.x contains a high-severity memory exhaustion vulnerability in its MSSQL client component. Remote SQL servers can exploit this flaw to crash client applications by forcing unbounded memory allocation.

What happened

The Eclipse Foundation disclosed CVE-2026-102462, a vulnerability rated 8.2 High on the CVSS scale. The flaw resides in the `vertx-mssql-client` module, specifically within the TDS message decoder. According to the National Vulnerability Database, the decoder aggregates inbound TDS packets into a composite direct-memory buffer. This process lacks any cumulative size limit for the incoming data stream.

An attacker controlling a SQL Server, or a man-in-the-middle position, can exploit this design. The malicious server sends a continuous stream of TDS packets to the client. Crucially, the attacker does not set the `END_OF_MESSAGE` status flag on these packets. Because the flag is missing, the client continues to allocate direct memory for the incoming data indefinitely.

This activity occurs before the authentication process completes. The unbounded memory consumption eventually leads to an out-of-memory condition. The client application crashes as a result of the resource exhaustion. This behavior affects multiple version branches of the software.

Why it matters

The affected versions span a wide range of the Eclipse Vert.x lifecycle. Versions 4.0.0 through 4.5.34 are impacted by this issue. The 5.0.x branch is affected from 5.0.0 up to 5.0.12. Users of the 5.1.x line face risk from 5.1.0 through 5.1.9. The 5.2.0 release is also vulnerable to this attack vector.

The component involved is `io.vertx:vertx-mssql-client`. This is a core library for developers building applications that interact with Microsoft SQL Server databases. The lack of a size limit on the direct-memory buffer creates a significant availability risk. Since the crash happens before authentication, any reachable client instance is potentially vulnerable.

The attack does not require complex exploitation techniques. A compromised or malicious server simply needs to stream data without termination flags. This makes the vulnerability easy to trigger in environments where clients connect to untrusted or dynamic SQL endpoints.

What to watch

• Verify if your application uses `io.vertx:vertx-mssql-client` within the affected version ranges.
• Monitor for unexpected application restarts or out-of-memory errors in client logs.
• Check network connections to SQL servers for unusually large or continuous data transfers.
• Review deployment configurations to identify clients connecting to untrusted database endpoints.

Signals worth monitoring

Security teams should look for anomalies in memory usage patterns on client hosts running Vert.x applications. Sudden spikes in direct memory allocation without corresponding application load may indicate exploitation. Network logs should be examined for persistent TCP connections to SQL servers that transmit large volumes of data without standard termination sequences. Alerting on frequent out-of-memory crashes in database client processes can help identify active abuse. Teams should also verify that monitoring tools capture pre-authentication connection states, as this vulnerability triggers before identity verification occurs.

What to do and how to stay safe: Eclipse Vert.x

• Audit your dependency tree to identify if `vertx-mssql-client` is present in your projects.
• Check the specific version numbers against the affected ranges listed in CVE-2026-102462.
• Implement connection timeouts and data size limits at the network or proxy layer if possible.
• Wait for the vendor to release an update that adds cumulative size limits to the TDS buffer.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Eclipse Vert.x are affected by CVE-2026-102462?

Versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 are affected.

Does the attacker need to authenticate to exploit this vulnerability?

No, the memory exhaustion occurs before the authentication process completes.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-102462 as 8.2 High.