CVE-2026-102462
Description
A flaw was found in the Vert.x MSSQL client. A malicious, compromised, or adversary-in-the-middle database server can cause a Denial of Service (DoS) by sending a continuous stream of Tabular Data Stream (TDS) packets without setting the end-of-message flag. Because the client aggregates inbound packets into direct memory without enforcing a cumulative size limit, this flaw can lead to unbounded memory consumption and crash the application before authentication finishes.
Statement
A moderate severity denial of service flaw was found in the Vert.x MSSQL client (vertx-mssql-client), a component of the Red Hat build of Quarkus. The TDS message decoder in the client aggregates inbound Tabular Data Stream (TDS) packets into a composite direct-memory buffer without enforcing any cumulative size limit. A malicious, compromised, or man-in-the-middle SQL Server can send a continuous stream of TDS packets without setting the end-of-message status flag, causing unbounded direct-memory allocation on the client and an out-of-memory crash. The attack can occur before authentication completes, so no database credentials or user interaction are required; however, the attacker must control the SQL Server the client connects to or intercept that outbound database connection, which Red Hat assesses as high attack complexity. For this reason Red Hat rates the flaw MODERATE (CVSS 5.9), lower than the important severity (CVSS 8.2) assigned by the upstream CVE record. Within the Red Hat build of Quarkus, the affected streams are not currently slated for an immediate fix: one affected stream is out of support scope, and another is deferred because Red Hat does not file trackers for moderate-severity flaws without a high CVSS score. The residual risk is denial of service for applications that connect to untrusted or compromised SQL Servers, or over connections that can be intercepted by a man-in-the-middle.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | 5.9 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | High | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
