The Eclipse Vert.x MQTT client contains an unbounded map that holds every QoS 2 PUBLISH message received from a broker until a matching PUBREL packet is processed. Because this map imposes no size limit, a malicious or compromised broker can flood the client with distinct packet identifiers and refuse to send PUBREL responses, causing the client to retain each full message forever. This leads to unbounded memory growth and can culminate in out‑of‑memory termination of the Vert.x process, effectively denying service to any application that depends on it.

The flaw affects the io.vertx:vertx‑mqtt component in Eclipse Vert.x versions 4.0.0 to 4.5.34, 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and the single 5.2.0 release. These editions are part of the Eclipse Vert.x MQTT module used by projects that integrate Vert.x for MQTT communication.

The vulnerability has a CVSS v3 score of 8.2, indicating high severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at present. The flaw is not yet listed in the CISA KEV catalog. An attacker would need to control or compromise the MQTT broker to send the crafted QoS 2 messages and withhold PUBREL packets; compatibility with standard MQTT brokers means the threat could arise in legitimate production environments if an adversary gains broker access. Given the lack of an inbound retry limit, the exploit can be carried out continuously until the victim’s JVM exhausts heap space.