CVE-2026-102462 Eclipse Foundation CVE debrief

Who should care

Defenders responsible for Eclipse Vert.x deployments, particularly those using the MSSQL client, should assess exposure and verify the version of the client in use. They should prioritize patching or mitigating the vulnerability to prevent potential crashes. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-102462 is a high-severity vulnerability in the Eclipse Vert.x MSSQL client that can lead to out-of-memory crashes. Defenders should prioritize verifying the affected versions and applying patches or mitigations to prevent potential crashes.

• Potential out-of-memory crashes leading to denial of service.
• Requires verification of affected versions and potential impact on the system.
• Defenders should prioritize patching or mitigating the vulnerability to prevent potential crashes.

Technical summary

The TDS message decoder in the Vert.x MSSQL client aggregates inbound TDS packets into a composite direct-memory buffer without any cumulative size limit. A malicious SQL Server can send a continuous stream of TDS packets without setting the END_OF_MESSAGE status flag, causing unbounded direct-memory allocation on the client and leading to an out-of-memory crash. This occurs before authentication completes, making it a significant concern for defenders. The impacted component is io.vertx:vertx-mssql-client. Defenders should prioritize verifying the affected versions of the Eclipse Vert.x MSSQL client and applying patches or mitigations to prevent potential out-of-memory crashes.

Defensive priority

Defenders should prioritize verifying the affected versions of the Eclipse Vert.x MSSQL client and applying patches or mitigations to prevent potential out-of-memory crashes.

Recommended defensive actions

• Verify the version of the Eclipse Vert.x MSSQL client in use and check if it falls within the affected ranges.
• Apply patches or mitigations provided by the vendor to prevent potential out-of-memory crashes.
• Monitor the system for signs of out-of-memory crashes or other unusual behavior.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, but the scope of affected versions and potential impact require further verification. The Eclipse Vert.x MSSQL client is impacted, specifically versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0]. Defenders should verify the version of the client in use and check if it falls within the affected ranges. The TDS message decoder's behavior and the potential for out-of-memory crashes should be reviewed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.