Vert.x MySQL Client EUVD-2026-101957

Exploitation requires the Vert.x application to receive a MySQL result-set packet from an attacker-influenced source: either the MySQL server itself is malicious or compromised, or the attacker holds a man-in-the-middle position on the client-to-database connection (feasible where TLS is absent or not enforced on the DB link). The specific trigger is a crafted result-set packet declaring an extremely large column count, which the client pre-allocates without upper-bound validation. Limiting factors: in standard deployments the database is a trusted, operator-controlled endpoint, so an attacker must first subvert the DB server or the network path - this is why the vendor rates AC:H. No authentication or user interaction is needed once the hostile server/MITM position exists. Affected only when running vertx-mysql-client in versions [4.0.0,4.5.34], [5.0.0,5.0.12], [5.1.0,5.1.9], or 5.2.0.

This is a denial-of-service-only flaw (CVSS 4.0 VA:H, with VC:N/VI:N - no confidentiality or integrity impact), scored 8.2/HIGH by the reporting party (Eclipse). The CVSS 4.0 vector reports AV:N/AC:H/PR:N/UI:N, meaning network reachable and unauthenticated, but with HIGH attack complexity. That complexity rating is the decisive signal: exploitation requires the attacker to control the MySQL server the Vert.x client connects to (a malicious or compromised database server) or to hold a man-in-the-middle position on the client-to-DB connection. In normal deployments the application connects to a trusted, operator-controlled database, so this is not a typical internet-facing remote DoS despite AV:N. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no evidence of active exploitation or public exploit code. CWE is listed as N/A. Net: a legitimately HIGH-severity availability bug for the affected library, but real-world priority is moderated by the requirement for a hostile DB server or MITM - treat it as patch-on-cycle for most, prioritized only where the DB trust boundary is weak (shared/multi-tenant DB, untrusted network path, or externally-sourced DB endpoints).

A Vert.x application using vertx-mysql-client connects to a MySQL server that is attacker-controlled or has been compromised (or the attacker intercepts the unencrypted/MITM-able DB connection). The server returns a crafted result-set packet declaring an enormous column count, causing the client to pre-allocate a massive column-definition array, triggering an OutOfMemoryError that crashes the Netty event-loop thread and takes down all connections and verticles. No public exploit code was identified in the provided data.