Vert.x MSSQL Client CVE-2026-102462

The vulnerable Vert.x MSSQL client (io.vertx:vertx-mssql-client) must initiate a connection to a SQL Server that the attacker controls, has compromised, or can man-in-the-middle; the attacker then sends a continuous stream of TDS packets without ever setting the END_OF_MESSAGE status flag, causing the client's TDS message decoder to grow a composite direct-memory buffer without limit. The flaw is reachable before authentication completes, so valid credentials and server-side auth are NOT required. Limiting factors: exploitation is NOT possible by an arbitrary remote attacker - it demands an adversarial server position or network MITM (reflected as CVSS AC:H), and impact is confined to crashing the client process (availability only, no data exposure or code execution). Affected versions: Vert.x [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and 5.2.0.

Signals are mixed and point to a moderate, situational risk rather than a top-tier emergency. The Eclipse-assigned CVSS 4.0 score of 8.2 looks alarming, but it is driven almost entirely by VA:H (availability) combined with AV:N/PR:N/UI:N, while AC:H materially tempers it: exploitation requires the attacker to BE the SQL Server the client connects to, to have compromised it, or to man-in-the-middle the TDS connection - not a position any arbitrary internet attacker holds. Impact is availability-only (VC:N/VI:N/VA:H): a client-side out-of-memory crash, with no confidentiality or integrity loss and no code execution. Exploitation status is 'no public exploit identified at time of analysis' - there is no KEV listing and no POC referenced in the provided data. EPSS is NOT provided in the input, so exploitation probability cannot be quantified. The genuine aggravating factor is that the flaw triggers before authentication completes, so TLS/credential controls do not protect against a malicious or MITM server. Net: treat as a real but conditional denial-of-service bug - prioritize for environments where Vert.x clients connect to untrusted or externally-reachable SQL Server endpoints, and deprioritize where the DB server is trusted and network-isolated. Verify EPSS independently since it was absent from this feed.

An application using the Vert.x MSSQL client connects to a SQL Server that is attacker-controlled, has been compromised, or whose traffic the attacker can intercept (MITM). Before the login handshake completes, the server streams a continuous sequence of TDS packets while never setting the END_OF_MESSAGE status flag, so the client keeps aggregating them into a single composite direct-memory buffer with no cap, exhausting direct memory and crashing the client process. No public exploit code is referenced in the available data; the attack is low-skill to execute but requires the adversary to occupy the server/MITM position (CVSS AC:H).