The vulnerability resides in the binary array decoder of the Vert.x PostgreSQL client, where allocating an array based solely on a server‑declared 32‑bit dimension can trigger a multi‑gigabyte heap allocation. This results in an OutOfMemoryError that causes the client process to terminate, disrupting services that rely on the client for database interaction. The weakness is a classic heap overflow scenario described by CWE‑789.

Eclipse Vert.x, specifically the vertx-pg-client component. Affected releases are 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0. No other vendors or product variants are listed.

The CVSS score is 8.2, indicating high severity, but the EPSS score is less than 1 %, suggesting a low likelihood of exploitation at this time. The vulnerability is not included in the CISA KEV catalog. An attacker could exploit the flaw by acting as a compromised server or as an on‑path actor intercepting an unencrypted connection, sending a crafted DataRow with an oversized dimension to force the client to crash. The impact is limited to the client process but can cascade into service downtime for applications relying on it.