Eclipse Vert.x's MySQL client aggregates inbound packets into a composite direct-memory buffer without a cumulative size limit. A malicious or compromised MySQL server can send a stream of maximum-size packets before authentication, preventing an end-of-message marker and forcing the client to allocate more memory ad hoc. This leads to an out-of-memory crash and causes the client process to terminate, resulting in denial of service. The flaw is an unbounded memory allocation issue (CWE-789) that can be exploited remotely via the communication channel with a MySQL server.

The vulnerable component is io.vertx:vertx-mysql-client, distributed as part of Eclipse Vert.x. Affected releases include Vert.x 4.0.0 through 4.5.34, Vert.x 5.0.0 through 5.0.12, Vert.x 5.1.0 through 5.1.9, and the single 5.2.0 revision. All other Vert.x versions are unaffected.

The CVSS score of 8.2 indicates high severity; however, the current EPSS score is below 1% and the vulnerability is not listed in CISA's KEV catalog, suggesting limited known exploitation. Based on the description, it is inferred that an attacker would need to position a malicious MySQL server or act as a man-in-the-middle to send the crafted packet stream, and the vulnerability is triggered before authentication completes, meaning any client connecting to the server is at risk.