CVE-2026-103223

A MODERATE severity denial-of-service flaw was found in the Eclipse Vert.x PostgreSQL client (vertx-pg-client), which is shipped in the Red Hat Build of Quarkus. The client's PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without validating it against a maximum. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header declaring an extremely large length before authentication completes, causing the client to buffer incoming network data without bound, leading to excessive memory consumption and an out-of-memory crash of the client application. Exploitation requires the attacker to control or intercept the connection to the PostgreSQL server, and only the availability of the client application is affected. Red Hat rates this flaw MODERATE (CVSS 5.9), while the upstream CVE record assigns a higher score (8.2 under CVSS 4.0); the difference stems from the different scoring methodologies. Within the Red Hat Build of Quarkus, the affected streams are marked AFFECTED: one affected stream is out of support scope, and for the in-support stream the fix is deferred because this flaw is MODERATE severity with a CVSS score below 7.0, which does not meet the threshold for prioritizing a fix. Until a fix is delivered, the residual risk is a denial of service of applications that connect to an untrusted, compromised, or intercepted PostgreSQL server.