CVE-2026-102469

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.34 Eclipse Vert.x versions 5.0.0 through 5.0.12 Eclipse Vert.x versions 5.1.0 through 5.1.9 Eclipse Vert.x version 5.2.0

Description The vertx-db2-client component contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using ObjectInputStream.readObject() without an ObjectInputFilter or class allowlist. This occurs when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). While legitimate DB2 servers do not use this type, a malicious or man-in-the-middle server can send a crafted response to force the client to deserialize arbitrary bytes on the Vert.x event loop. This can lead to remote code execution if a Java deserialization gadget chain is present on the classpath, or a denial of service via crafted object graphs. The risk is increased because TLS is disabled by default.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.