The Eclipse Vert.x DB2 client contains a deserialization flaw in its DRDA protocol handling. When a DRDA server sends data marked as a User Defined Type (UDT) over the FDOCA protocol, the client blindly calls ObjectInputStream.readObject() without an ObjectInputFilter or any class allowlist. Because DB2 never emits such a type, the code path is normally unreachable, but a malicious or man‑in‑the‑middle server can craft a response that triggers the path and supplies attacker‑controlled bytes. If the application’s classpath includes a Java deserialization gadget chain, this can lead to remote code execution; otherwise, the malicious payload can cause denial of service. The attack occurs on the Vert.x event loop, before application code can validate or reject the data, and TLS is disabled by default, making MITM exploitation feasible.

Eclipse Vert.x developers using the Vert.x DB2 client (io.vertx:vertx-db2-client) should be aware that versions within the ranges 4.0.0–4.5.34, 5.0.0–5.0.12, 5.1.0–5.1.9, and 5.2.0 are affected. Updated releases outside these ranges are not listed as impacted.

The CVSS score is 9.2, indicating a high severity vulnerability. The EPSS score is less than 1%, suggesting that, while exploitation is possible, actual attacks are currently rare. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the most likely attack vector is a remote or man‑in‑the‑middle DRDA server that sends crafted UDT data. If an application includes a vulnerable gadget chain, the attacker can achieve remote code execution; otherwise, denial of service is probable. The lack of TLS by default increases feasibility of MITM attacks.