The Eclipse Vert.x MySQL client allocates an array for column definitions based on the column count announced by the MySQL server, but it does not enforce an upper bound. A malicious or compromised MySQL server, or a man‑in‑the‑middle attacker, can send a packet declaring an extremely large column count, which forces the client to request a massive heap allocation. The resulting OutOfMemoryError crashes the Netty event loop thread, bringing down all Vert.x connections and verticles. The primary impact is service interruption without granting code execution or data compromise.

The affected product is Eclipse Vert.x MySQL client (vertx-mysql-client), available from the Eclipse Foundation. Vulnerable releases include versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and the single patch release 5.2.0. All other newer releases are believed to include the fix.

The CVSS score of 8.2 indicates a high severity vulnerability, and the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to be able to influence the MySQL server the application connects to, either by compromising the server itself or by intercepting traffic to inject a crafted packet. The exploit path is therefore network‑centric, and while unlikely to be widely used today, it could be leveraged by an adversary with sufficient control over the database endpoint to cause a denial of service for the entire Vert.x application.