CVE-2026-102466

A denial of service vulnerability of moderate impact was found in the Vert.x MySQL client (vertx-mysql-client) as shipped in Red Hat Build of Quarkus 3 (quarkus-3). The client pre-allocates an array for column definitions based on a server-declared column count without validating an upper bound. A malicious or compromised MySQL server, or an attacker in a man-in-the-middle position on the network path between the application and its database, can send a crafted result set packet declaring an extremely large column count, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Netty event loop thread, disrupting all connections and verticles of the Vert.x application. Red Hat rates this flaw MODERATE (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9) because exploitation requires conditions outside the attacker's direct control.

The affected vertx-mysql-client component is shipped in Red Hat Build of Quarkus. The quarkus-3.33 stream is affected and the fix is deferred because Red Hat does not file trackers for moderate-severity flaws with a CVSS 3.1 score below 7.0; until a fixed version is delivered, applications that connect to an untrusted, compromised, or network-exposed MySQL server remain exposed to a complete denial of service of the Vert.x application. The quarkus-3.27 stream is also affected but is out of support scope.

The CVE record carries a CVSS 4.0 score of 8.2 (IMPORTANT) from the CVE program, while Red Hat and the upstream Eclipse Vert.x advisory both rate this flaw at 5.9 (MODERATE/medium) using CVSS 3.1. The difference stems from the CVSS 4.0 model producing a higher score for this availability-only flaw and from the high attack complexity: exploitation requires a malicious or compromised database server or a man-in-the-middle position.