CVE-2026-102463
Description
A flaw was found in vertx-pg-client. The binary array decoder does not enforce an upper bound on server-declared array dimensions during memory allocation. A malicious database server or an on-path attacker intercepting an unencrypted connection can exploit this flaw by sending a crafted message containing an excessively large dimension value. This forces the client application to attempt an excessive memory allocation, leading to a Denial of Service (DoS) through an out-of-memory crash.
Statement
A flaw of MODERATE impact was found in the Vert.x PostgreSQL client (vertx-pg-client), which is shipped in the Red Hat build of Quarkus. The binary array decoder (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit array dimension count without enforcing an upper bound. A malicious or compromised PostgreSQL server, or an on-path attacker who can intercept an unencrypted connection between the client and the database, can send a crafted DataRow message with an excessively large array dimension value, causing the client to attempt a multi-gigabyte heap allocation and crash with an OutOfMemoryError. This results in denial of service of the client application; confidentiality and integrity are not affected.
Red Hat rates this flaw MODERATE severity (CVSS 3.1 score 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) because successful exploitation requires the attacker to control or compromise the PostgreSQL server, or to be positioned on the network path of an unencrypted client-server connection. The CVEORG issuer scores the flaw higher (CVSS 4.0 score 8.2, IMPORTANT) based on the same availability-only impact; the difference reflects Red Hat's assessment of the high attack complexity.
Both Red Hat build of Quarkus streams that ship vertx-pg-client are affected. For the quarkus-3.33 stream, the fix is deferred because the flaw is rated MODERATE with a CVSS score below 7.0 and Red Hat does not file trackers for moderate-severity flaws without high CVSS scores; the residual risk until a fix is delivered is denial of service of client applications that connect to a malicious, compromised, or network-intercepted PostgreSQL server. The quarkus-3.27 stream is out of support scope, so no fix is planned for it.
Mitigation
Exploitation by an on-path attacker requires an unencrypted connection between the client and the PostgreSQL server; configuring vertx-pg-client to use SSL/TLS-encrypted database connections prevents this attack path. This does not protect against a malicious or compromised PostgreSQL server itself. For that vector, mitigation is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | 5.9 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | High | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
