CVE-2026-102464 Eclipse Foundation CVE debrief

Who should care

Defenders of systems using Eclipse Vert.x MQTT client, particularly those with exposure to untrusted MQTT brokers, should assess their environment for potential vulnerability and prioritize remediation.

Why it matters

CVE-2026-102464 is a high-severity vulnerability in Eclipse Vert.x MQTT client that can lead to unbounded memory growth and potential out-of-memory termination. Defenders of systems using this client, especially those exposed to untrusted MQTT brokers, should assess their environment, verify affected versions, and prioritize remediation.

• Potential for out-of-memory termination of MQTT-consuming applications
• Degradation of MQTT-consuming application performance
• Need for verification of affected versions and exposure
• Priority for remediation and compensating controls

Technical summary

Eclipse Vert.x MQTT client stores inbound QoS 2 PUBLISH messages in an internal map without size limits, allowing for unbounded memory growth. A malicious MQTT broker can exploit this by sending QoS 2 PUBLISH messages with distinct packet identifiers and withholding PUBREL responses. The impacted component is io.vertx:vertx-mqtt. Defenders should assess exposure, prioritize remediation, and verify affected versions to prevent potential out-of-memory termination and degradation of MQTT-consuming application performance.

Defensive priority

High

Recommended defensive actions

• Assess exposure of Vert.x MQTT client in your environment
• Verify affected versions and prioritize remediation
• Monitor for suspicious MQTT traffic
• Consider compensating controls for memory usage
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence is limited. Official sources indicate affected versions and provide CVSS scores. The Eclipse Vert.x MQTT client stores inbound QoS 2 PUBLISH messages in an internal map without size limits, allowing for unbounded memory growth. Defenders should verify affected versions, assess exposure, and prioritize remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.