Eclipse Vert.x CVE-2026-103224

Exploitation requires that the attacker control the MySQL server side of the connection - either by running a malicious server the Vert.x client is induced to connect to, compromising a legitimate MySQL server, or performing a man-in-the-middle on the client-to-server link (which is why CVSS rates AC:H). The specific trigger is a continuous stream of MySQL protocol packets each using the maximum payload length (0xFFFFFF), which prevents the io.vertx:vertx-mysql-client message decoder from ever reaching the end-of-message boundary. No authentication or user interaction is needed because the unbounded direct-memory aggregation happens before the authentication handshake completes. Limiting factors: the victim is the MySQL *client*, not a server, so only applications using vertx-mysql-client in the affected ranges that connect to attacker-controllable or interceptable database endpoints are at risk; deployments where all MySQL endpoints are trusted and traffic is protected against MITM materially reduce exposure.

This is a genuine availability (denial-of-service) issue, but its real-world priority is moderate rather than urgent once the full signal set is weighed. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) correctly captures that impact is confined to availability (VA:H) with no confidentiality or integrity loss, and that attack complexity is High - the decisive and often-overlooked precondition is that the attacker must operate or impersonate the MySQL *server* the Vert.x client connects to (malicious, compromised, or man-in-the-middle). The pre-authentication nature (PR:N) means the crash is triggered before credentials are exchanged, so no valid DB account is needed, which raises severity for scenarios where clients reach untrusted or network-adjacent database endpoints. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied in the input, so there is no evidence of active or automatable exploitation; the 8.2 'High' base score reflects theoretical reachability, not observed attacks. Net assessment: a credible self-inflicted/MITM DoS against Vert.x MySQL clients, worth patching in environments where database connections can be intercepted or where clients may be pointed at untrusted servers, but not a drop-everything issue given the AC:H server-control requirement and absence of any exploitation telemetry.

An attacker who controls, compromises, or can man-in-the-middle the MySQL server endpoint that a Vert.x application connects to responds to the client's connection with a continuous stream of MySQL packets each carrying the maximum payload length (0xFFFFFF). Because the client-side message decoder keeps aggregating these multi-packet payloads into a composite direct-memory buffer with no cumulative cap, the end-of-message condition never fires and direct memory grows without bound until the client JVM crashes with an out-of-memory error. No public exploit identified at time of analysis, and the crash occurs before authentication completes, so no valid database credentials are required.