CVE-2026-102462

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.34 Eclipse Vert.x versions 5.0.0 through 5.0.12 Eclipse Vert.x versions 5.1.0 through 5.1.9 Eclipse Vert.x version 5.2.0

Description The TDS message decoder in the vertx-mssql-client component aggregates inbound TDS packets into a composite direct-memory buffer without a cumulative size limit. A malicious or compromised SQL Server can send a continuous stream of TDS packets without the END OF MESSAGE status flag, resulting in unbounded direct-memory allocation and an out-of-memory crash on the client. This issue can be triggered before authentication is completed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.