# CVE-2026-102462: Eclipse Vert.x MSSQL client denial of service in TDS message decoder

Source: https://junglewise.ai/threats/cve-2026-102462-in-eclipse-vert-x-versions-4-0-0-4-5-34-or-5-0-0-5-0-12-or-5-1-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-102462 · Severity: medium · CVSS 5.9 · Published 2026-10-15

Eclipse Vert.x's MSSQL client library is used to connect applications to SQL Server databases. A malicious or compromised SQL Server can send a continuous stream of incomplete TDS protocol messages that the client accumulates without limit, exhausting memory and crashing the application before the user even authenticates. An attacker can trigger this remotely without valid credentials.

Technologies: [Eclipse Vert.X](https://junglewise.ai/threats/technologies/eclipse-vert-x). Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-102462 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102462 being exploited in the wild.

**How severe is CVE-2026-102462?** Medium severity, with a CVSS score of 5.9, published 15 October 2026.

**Which products and versions are affected?** Eclipse Vert.x MSSQL client 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, 5.2.0.

**Is there a fix for CVE-2026-102462?** Yes: fixed in 4.5.35, 5.1.10, 5.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102462 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-102462?** Check whether you run Eclipse Vert.X or Eclipse Vert.x MSSQL client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.5.35, 5.1.10, 5.2.1

## Technical details

The TDS message decoder in vertx-mssql-client aggregates inbound protocol packets into a composite direct-memory buffer without enforcing a cumulative size limit. An attacker controlling or intercepting the SQL Server connection can send a stream of TDS packets that omit the END_OF_MESSAGE flag, causing unbounded heap allocation and an out-of-memory crash. This vulnerability exists before authentication, allowing pre-auth denial of service.

## Affected products

- Eclipse Vert.x MSSQL client 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, 5.2.0

## Timeline

- 2026-10-07: advisory
- 2026-10-15: disclosed

## References

- [https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-fg6c-83v6-vhq4](https://github.com/eclipse-vertx/vertx-sql-client/security/advisories/GHSA-fg6c-83v6-vhq4)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/346](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/346)

## Related threats

- [Eclipse Vert.x STOMP FrameParser heap exhaustion](https://junglewise.ai/threats/cve-2026-118487-in-eclipse-vert-x-versions-4-0-0-4-5-35-or-5-0-0-5-2-2-the)
- [Eclipse Vert.x CachingWebClient cross-user cache disclosure](https://junglewise.ai/threats/cve-2026-118489-in-eclipse-vert-x-versions-4-0-0-4-5-35-or-5-0-0-5-2-2-when-one)
- [Eclipse Vert.x PostgreSQL client unbounded memory allocation](https://junglewise.ai/threats/cve-2026-103223-in-eclipse-vert-x-versions-4-0-0-4-5-34-or-5-0-0-5-0-12-or-5-1-0)
- [Eclipse Vert.x gRPC compression bomb denial of service](https://junglewise.ai/threats/cve-2026-102477-in-eclipse-vert-x-versions-4-0-0-4-5-34-or-5-0-0-5-0-12-or-5-1-0)
- [Eclipse Vert.x DB2 client unsafe Java deserialization in UDT handling](https://junglewise.ai/threats/cve-2026-102469-in-eclipse-vert-x-versions-4-0-0-4-5-34-or-5-0-0-5-0-12-or-5-1-0)