Is CVE-2026-102469 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102469 being exploited in the wild.

How severe is CVE-2026-102469?

Medium severity, with a CVSS score of 5.9, published 15 October 2026.

Which products and versions are affected?

Eclipse Vert.x DB2 client 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, 5.2.0.

Is there a fix for CVE-2026-102469?

Yes: fixed in 4.5.35, 5.1.10, 5.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102469 attacked?

It is attacked over the network.

Am I affected by CVE-2026-102469?

Check whether you run Eclipse Vert.X or Eclipse Vert.x DB2 client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102469: Eclipse Vert.x DB2 client unsafe Java deserialization in UDT handling

CVE-2026-102469 · Severity: medium · CVSS 5.9 · Published 2026-10-15

Eclipse Vert.x's DB2 client library, used by applications to connect to IBM DB2 databases, contains a flaw in how it processes database result data. An attacker controlling the database connection or intercepting network traffic can send maliciously crafted data that triggers arbitrary code execution on the application server, or at minimum causes it to crash. Since TLS is disabled by default, such attacks are feasible without compromising encryption.

Technologies: Eclipse Vert.X. Vendors: Eclipse.

Quick answers

Is CVE-2026-102469 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102469 being exploited in the wild.
How severe is CVE-2026-102469?: Medium severity, with a CVSS score of 5.9, published 15 October 2026.
Which products and versions are affected?: Eclipse Vert.x DB2 client 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, 5.2.0.
Is there a fix for CVE-2026-102469?: Yes: fixed in 4.5.35, 5.1.10, 5.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102469 attacked?: It is attacked over the network.
Am I affected by CVE-2026-102469?: Check whether you run Eclipse Vert.X or Eclipse Vert.x DB2 client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.5.35, 5.1.10, 5.2.1

Technical details

The DB2 client deserializes User Defined Type (UDT) column data using ObjectInputStream.readObject() without an ObjectInputFilter or class allowlist, allowing arbitrary deserialization. A malicious or man-in-the-middle DRDA server can trigger this by sending a result set with a column tagged as FDOCA protocol LID 0x50, causing unsafe deserialization on the Vert.x event loop before application code can inspect the data. Exploitation to remote code execution is possible if a Java deserialization gadget chain exists on the classpath; denial of service is possible without one.

Affected products

Eclipse Vert.x DB2 client 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, 5.2.0

Timeline

2026-10-07: disclosed
2026-10-15: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.