CVE-2026-102469
- Source
- https://cve.org/CVERecord?id=CVE-2026-102469
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102469.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-102469
- Aliases
-
- GHSA-j4vf-w939-pgxf
- Published
- 2026-10-15T08:11:33Z
- Modified
- 2026-10-28T02:31:12Z
- Severity
-
- 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- [none]
- Details
-
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist.
This code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). However, DB2 does not support this type of UDT. The FDOCA 0x50 type is never sent by a legitimate DB2 server.
Nevertheless, a malicious or man-in-the-middle DRDA server could craft a response with a 0x50-tagged column, causing the client to deserialize arbitrary attacker-controlled bytes on the Vert.x event loop before any application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this enables remote code execution. Without a gadget chain, denial of service is possible via crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible.
The impacted component is io.vertx:vertx-db2-client.
- Database specific
{ "cna_assigner": "eclipse", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102469.json" }- References
Affected packages
Git / github.com/eclipse-vertx/vert.x
Affected ranges
- Type
- GIT
- Repo
- https://github.com/eclipse-vertx/vert.x
- Events
-
IntroducedFixedIntroducedFixedIntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.5.0" }, { "fixed": "4.5.35" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.0.0" }, { "fixed": "5.1.10" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:eclipse:vert.x:5.2.0:*:*:*:*:*:*:*", "range": [ { "introduced": "5.2.0" }, { "last_affected": "5.2.0" } ], "source": "CPE_STRING" } ] }
- Type
- GIT
- Repo
- https://github.com/eclipse-vertx/vertx-sql-client
- Events
-
IntroducedFixedIntroducedFixedIntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.5.0" }, { "fixed": "4.5.35" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.0.0" }, { "fixed": "5.1.10" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:eclipse:vert.x:5.2.0:*:*:*:*:*:*:*", "range": [ { "introduced": "5.2.0" }, { "last_affected": "5.2.0" } ], "source": "CPE_STRING" } ] }
- Type
- GIT
- Repo
- https://github.com/vert-x3/vertx-web
- Events
-
IntroducedFixedIntroducedFixedIntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.5.0" }, { "fixed": "4.5.35" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*", "range": [ { "introduced": "5.0.0" }, { "fixed": "5.1.10" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:eclipse:vert.x:5.2.0:*:*:*:*:*:*:*", "range": [ { "introduced": "5.2.0" }, { "last_affected": "5.2.0" } ], "source": "CPE_STRING" } ] }