In the Vert.x PostgreSQL client, the decoder parses a 4‑byte length field from the server without imposing an upper bound. A malicious or compromised PostgreSQL server can send a length of up to Integer.MAX_VALUE, causing the client to allocate an unbounded buffer. This leads to an out‑of‑memory crash before authentication completes, resulting in a denial of service. The weakness is a classic buffer allocation vulnerability (CWE-770 and CWE-789). Based on the description, the likely attack vector is a remote PostgreSQL server or a man‑in‑the‑middle tampering with the wire protocol.

Eclipse Vert.x's vertx‑pg‑client component, released under the Eclipse Foundation, is affected in Vert.x 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and the single 5.2.0 release.

With a CVSS score of 8.2, the vulnerability is considered high severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the attacker only needs to connect to a PostgreSQL instance that can send a crafted message; a compromised or malicious server can trigger the overflow. If an application relies on Vert.x to communicate with external PostgreSQL servers over insecure networks, the risk of a DoS attack is significant despite the low exploitation probability.