CVE-2026-102469

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102469
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102469.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102469
Aliases
  • GHSA-j4vf-w939-pgxf
Published
2026-10-15T08:11:33Z
Modified
2026-10-16T02:47:48Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
[none]
Details

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist.

This code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). However, DB2 does not support this type of UDT. The FDOCA 0x50 type is never sent by a legitimate DB2 server.

Nevertheless, a malicious or man-in-the-middle DRDA server could craft a response with a 0x50-tagged column, causing the client to deserialize arbitrary attacker-controlled bytes on the Vert.x event loop before any application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this enables remote code execution. Without a gadget chain, denial of service is possible via crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible.

The impacted component is io.vertx:vertx-db2-client.

Database specific 
{
    "cna_assigner":  "eclipse",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102469.json"
}
References

Affected packages

Git / github.com/eclipse-vertx/vertx-sql-client

Affected ranges

Type
GIT
Repo
https://github.com/eclipse-vertx/vertx-sql-client
Events
Introduced
9d9d56dc8bcd30e525e177ff462212b11c55dd07
Last Affected
6acce64664eabc086fc0fe1ea0ad9a21a153594c
Introduced
6837af793026a2fba5b6b32e0161fce6d9c8b691
Last Affected
fb40976c228a72763d595bbb8499feabd39166f1
Introduced
1d93c2e48aafcaa38af40154205c7810f66e1cc2
Last Affected
84f06a87043a873160492923154b044c80b16f32
Introduced
3708bdc1d328afce37abd39dba932399a0469742
Last Affected
3708bdc1d328afce37abd39dba932399a0469742
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "last_affected":  "4.5.34"
        },
        {
            "introduced":  "5.0.0"
        },
        {
            "last_affected":  "5.0.12"
        },
        {
            "introduced":  "5.1.0"
        },
        {
            "last_affected":  "5.1.9"
        },
        {
            "introduced":  "5.2.0"
        },
        {
            "last_affected":  "5.2.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.1.0
4.1.0.Beta1
4.1.0.CR1
4.1.0.CR2
4.1.1
4.2.0
4.2.0.Beta1
4.2.0.CR1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.5.0
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.15
4.5.16
4.5.17
4.5.18
4.5.19
4.5.2
4.5.20
4.5.21
4.5.22
4.5.23
4.5.24
4.5.25
4.5.26
4.5.27
4.5.28
4.5.29
4.5.3
4.5.30
4.5.31
4.5.32
4.5.33
4.5.34
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
5.*
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102469.json"