The Eclipse Vert.x MSSQL client contains an issue in its TDS (Tabular Data Stream) message decoder. The decoder aggregates inbound TDS packets into a composite direct‑memory buffer without imposing any cumulative size limit. A malicious, compromised, or man‑in‑the‑middle SQL Server can send a continuous stream of TDS packets that never set the END_OF_MESSAGE flag, causing the client to allocate memory unboundedly. The attack occurs before authentication completes, leading the client to exhaust its direct‑memory allocation and crash. The result is a denial‑of‑service condition for any application relying on that Vert.x component. This flaw is classified as CWE‑400: Uncontrolled Resource Consumption.

The affected product is Eclipse Vert.x, specifically the vertx‑mssql‑client component provided by the Eclipse Foundation. Vulnerable releases include versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and the single 5.2.0 release. Organizations using any of these combinations should assess whether their SQL Server clients expose the vulnerable Vert.x library to untrusted network traffic.

The CVSS score of 8.2 marks the flaw as high severity. The EPSS score is reported as less than 1 %, indicating a low probability of exploitation in the wild, and it is not listed in CISA’s KEV catalog. Nevertheless, because the vulnerability can cause an immediate crash without requiring local code execution, it poses a significant risk to services that demand high availability. Based on the description, it is inferred that the attack vector is network‑based: an adversary with the ability to send arbitrary TDS packets to the client before authentication can trigger the memory overflow.