Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-102462 Overview
CVE-2026-102462 is a denial-of-service vulnerability in the Eclipse Vert.x MSSQL client (io.vertx:vertx-mssql-client). The Tabular Data Stream (TDS) message decoder aggregates inbound TDS packets into a composite direct-memory buffer without enforcing any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can stream TDS packets indefinitely while withholding the END_OF_MESSAGE status flag. This forces unbounded direct-memory allocation on the client and triggers an out-of-memory crash. The condition is reachable before authentication completes, so no credentials are required to exploit it. The weakness is tracked as [CWE-400] Uncontrolled Resource Consumption.
Critical Impact
Unauthenticated remote attackers controlling or intercepting SQL Server traffic can crash Vert.x client applications through direct-memory exhaustion.
Affected Products
- Eclipse Vert.x versions 4.0.0 through 4.5.34
- Eclipse Vert.x versions 5.0.0 through 5.0.12 and 5.1.0 through 5.1.9
- Eclipse Vert.x version 5.2.0
Discovery Timeline
- 2026-10-15 - CVE-2026-102462 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-102462
Vulnerability Analysis
The Vert.x MSSQL client communicates with Microsoft SQL Server using the TDS protocol. TDS messages are transmitted as a sequence of packets, and the final packet in a logical message carries the END_OF_MESSAGE status flag. The client decoder concatenates each incoming packet payload into a composite Netty direct-memory buffer until that flag arrives. Only then does the decoder hand the completed message to higher protocol layers.
The decoder never checks the aggregate size of the composite buffer during this accumulation phase. An attacker that controls the server endpoint can send a continuous stream of valid TDS packets with the end-of-message flag cleared. Each additional packet is appended to the direct-memory buffer, exhausting the Java Virtual Machine's off-heap memory region. When allocation fails, the application throws OutOfMemoryError and terminates.
Root Cause
The root cause is missing bounds enforcement during protocol-level reassembly in the vertx-mssql-client TDS message decoder. The implementation trusts the server to eventually set END_OF_MESSAGE and uses direct-memory buffers that bypass standard heap limits. Direct memory exhaustion impacts the entire JVM process rather than a single connection.
Attack Vector
Exploitation requires network-adjacent control of the SQL Server endpoint. Valid attack scenarios include a malicious database server, a compromised legitimate server, or an active man-in-the-middle on the TDS channel when TLS is absent or improperly validated. Because the flaw triggers during the pre-login handshake, the attacker needs no database credentials. A single connection attempt from a vulnerable client is sufficient to begin the memory-exhaustion sequence.
No public proof-of-concept exploit has been published. See the Eclipse Vert.x SQL Client Security Advisory for the maintainer's technical description.
Detection Methods for CVE-2026-102462
Indicators of Compromise
- java.lang.OutOfMemoryError: Direct buffer memory entries in Vert.x application logs during or immediately after an MSSQL connection attempt.
- Abrupt JVM termination or container restarts correlated with outbound TCP sessions to SQL Server port 1433.
- Sustained inbound TDS packet streams from a SQL Server endpoint without a terminating end-of-message packet.
Detection Strategies
- Monitor JVM metrics for rapid growth in java.nio direct-memory usage on hosts running vertx-mssql-client.
- Inspect network telemetry for long-lived TDS flows from database servers that transfer unusually large volumes before any login response.
- Alert on repeated application crashes with OutOfMemoryError stack traces referencing io.vertx.mssqlclient or Netty CompositeByteBuf classes.
Monitoring Recommendations
- Baseline normal TDS session sizes and durations, then alert on deviations exceeding configured thresholds.
- Enable Netty leak detection and direct-memory metrics in production Vert.x deployments.
- Capture process crash dumps so responders can confirm whether memory exhaustion originated in the MSSQL decoder path.
How to Mitigate CVE-2026-102462
Immediate Actions Required
- Upgrade io.vertx:vertx-mssql-client to a fixed release line published by the Vert.x maintainers.
- Restrict outbound connectivity from Vert.x application hosts to known, trusted SQL Server endpoints only.
- Enforce TLS with strict certificate validation on all TDS connections to eliminate man-in-the-middle exposure.
Patch Information
The Eclipse Vert.x project has released fixed versions outside the vulnerable ranges [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and 5.2.0. Review the GitHub Security Advisory GHSA-fg6c-83v6-vhq4 and the Eclipse GitLab CVE Assignment #346 for the exact patched versions and upgrade guidance.
Workarounds
- Cap JVM direct memory with -XX:MaxDirectMemorySize so a crash contains the blast radius, understanding this does not prevent the denial of service.
- Terminate Vert.x MSSQL traffic through a trusted TLS proxy that validates server certificates and enforces session timeouts.
- Isolate database clients in dedicated processes or containers so a crash does not take down co-located services.
# Example JVM flag to constrain direct-memory usage until patching is complete
java -XX:MaxDirectMemorySize=256m -jar vertx-app.jar
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
