CVE-2026-103224

A flaw of moderate impact was found in the vertx-mysql-client component shipped in Red Hat Build of Quarkus. The MySQL message decoder reassembles inbound multi-packet payloads into a composite direct-memory buffer without enforcing a cumulative size limit. A malicious, compromised, or man-in-the-middle MySQL server can continuously send packets with the maximum payload length (0xFFFFFF) before authentication completes, preventing the end-of-message condition from being reached. This results in unbounded direct-memory allocation on the client, which exhausts available memory and crashes the client application, causing a denial of service. Only the availability of the client application is impacted; confidentiality and integrity are not affected.

Exploitation requires the attacker to control or compromise the MySQL server to which the client connects, or to be positioned as a man-in-the-middle on that connection. For this reason Red Hat rates the flaw as moderate severity (CVSS 3.1 score 5.9), while the upstream CVE record assigns important severity (CVSS 4.0 score 8.2); the difference reflects the high attack complexity of the required attacker position.

Within Red Hat Build of Quarkus, the quarkus-3.27 stream that ships the affected component is out of support scope, and the fix for the quarkus-3.33 stream is deferred because the flaw is moderate severity with a CVSS 3.1 score below 7.0. The residual risk of the deferral is a denial of service of client applications in the limited scenario where an application connects to an attacker-controlled or compromised MySQL server, or over a connection an attacker can intercept.