Eclipse Vert.x EUVD-2026-101956

Exploitation requires the attacker to control the PostgreSQL server side of the connection (a malicious or already-compromised database server) OR to hold a man-in-the-middle position on the client-to-PostgreSQL TCP link; the flaw is in the client-side wire-protocol message decoder of io.vertx:vertx-pg-client. The specific trigger is a PostgreSQL message header whose 4-byte length field is set to an extremely large value (up to Integer.MAX_VALUE), which the decoder accepts without any maximum-size validation and accumulates into an unbounded composite buffer. Key limiting factor: this breaks the normal trust assumption that the database server is benign - a client connecting only to trusted, authenticated, TLS-protected PostgreSQL servers is not realistically exposed. Notably, the condition applies BEFORE authentication completes, so the attacker needs no valid database credentials, only server-side or network-path control. Affected: Vert.x 4.0.0-4.5.34, 5.0.0-5.0.12, 5.1.0-5.1.9, and 5.2.0.

This is a genuine but conditional availability risk, not a widespread-mass-exploitation priority. The provided CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) correctly captures the core trade-off: the attack is network-reachable and requires no privileges or user interaction, but carries AC:H because the attacker must occupy a privileged position - either operate a malicious/compromised PostgreSQL server the client connects to, or achieve a man-in-the-middle foothold on the client-to-database link. Impact is confidentiality/integrity NONE and availability HIGH only: this is a pure denial-of-service (OOM crash of the client application), consistent with the 'Denial Of Service' tag. No EPSS score, KEV listing, or POC indicator was supplied in the input, so there is no signal of active or probable exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' The AC:H requirement (trusted-server assumption must be broken) is the dominant risk-limiting factor and explains why an 8.2-rated flaw is realistically lower priority than a remote unauthenticated RCE: an attacker who already controls the database server or network path has limited incentive to merely crash the client. No conflicting signals were detected; the main gap is the absence of exploitation-probability data (EPSS/KEV), which must be sourced separately.

An attacker who controls a PostgreSQL endpoint - a rogue/compromised database server, or a man-in-the-middle on the client-to-DB TCP connection - waits for a Vert.x application using vertx-pg-client to connect. Before authentication completes, the attacker sends a PostgreSQL wire-protocol message header with the 4-byte length field set near Integer.MAX_VALUE, then streams data; the client accumulates it into an unbounded composite buffer until the JVM exhausts memory and crashes. No public exploit code was identified in the provided data, but the attack is trivial to script once server/MITM position is held.