CVE-2026-102463

A flaw was found in vertx-pg-client. The binary array decoder does not enforce an upper bound on server-declared array dimensions during memory allocation. A malicious database server or an on-path attacker intercepting an unencrypted connection can exploit this flaw by sending a crafted message...

CVE-2026-103223

A flaw was found in vertx-pg-client. A malicious, compromised, or intermediary database server can trigger a Denial of Service DoS condition by sending a message header containing an excessively large length value before authentication completes. Because the client does not properly validate the...

CVE-2026-102463

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the binary array decoder in vertx-pg-client DataTypeCodec.binaryDecodeArray allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL...

CVE-2026-103223

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send...

codes.rafael.task:task-processor-jdbc (1.10), com.datasqrl:sqrl-discovery (>=0.7.0, <=0.11.5) +52 more potentially affected by CVE-2026-103223 via io.vertx:vertx-pg-client (>=5.0.0, <=5.1.8)

io.vertx:vertx-pg-client MAVEN version =5.0.0, =0.7.0, =0.7.0, =0.7.0, =0.6.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.24.2, =2.4.0-rc1, =3.0.0 and more Source cves: CVE-2026-103223 Source advisory: MEND:CVE-2026-103223...

EUVD-2026-101956

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send...

CVE-2026-103223

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send...

CVE-2026-103223

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send...

CVE-2026-102463

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the binary array decoder in vertx-pg-client DataTypeCodec.binaryDecodeArray allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL...

CVE-2026-102463

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the binary array decoder in vertx-pg-client DataTypeCodec.binaryDecodeArray allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL...

CVE-2026-102463

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the binary array decoder in vertx-pg-client DataTypeCodec.binaryDecodeArray allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL...

CVE-2026-102463

Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and [5.2.0, 5.2.0] are vulnerable in the vertx-pg-client component. The DataTypeCodec.binaryDecodeArray function fails to enforce an upper bound on the 32-bit dimension count provided by a PostgreSQL server during binary ar...

com.datasqrl:sqrl-discovery (>=0.10.6, <=0.11.5), com.datasqrl:sqrl-planner (>=0.10.6, <=0.11.5) +32 more potentially affected by CVE-2026-102463 via io.vertx:vertx-pg-client (>=5.1.0, <=5.1.9)

io.vertx:vertx-pg-client MAVEN version =5.1.0, =0.10.6, =0.10.6, =0.10.6, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =18.0.0-rc1, =1.11.0, =1.11.0, =1.0.0, =1.0.7 and more Source cves: CVE-2026-102463 Source advisory: MEND:CVE-2026-102463...

EUVD-2026-101958

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the binary array decoder in vertx-pg-client DataTypeCodec.binaryDecodeArray allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL...

CVE-2026-102463

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the binary array decoder in vertx-pg-client DataTypeCodec.binaryDecodeArray allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL...

PT-2026-114834

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send...

PT-2026-114829

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the binary array decoder in vertx-pg-client DataTypeCodec.binaryDecodeArray allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL...

CVE-2026-103223: Memory Allocation with Excessive Size Value

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send...

CVE-2026-102463: Memory Allocation with Excessive Size Value

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the binary array decoder in vertx-pg-client DataTypeCodec.binaryDecodeArray allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised PostgreSQL...