CVE-2026-102463

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.34 Eclipse Vert.x versions 5.0.0 through 5.0.12 Eclipse Vert.x versions 5.1.0 through 5.1.9 Eclipse Vert.x version 5.2.0

Description The binary array decoder in the vertx-pg-client component contains a flaw where the DataTypeCodec.binaryDecodeArray() function allocates a Java array based on a 32-bit dimension count provided by the server without enforcing an upper bound. A compromised PostgreSQL server or an attacker intercepting an unencrypted connection can send a crafted DataRow message with an excessively large array dimension value. This triggers a multi-gigabyte heap allocation, leading to an OutOfMemoryError and causing the client to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.