In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send a message header with the length field set to an extremely large value (up to Integer.MAX_VALUE), causing the decoder to accumulate subsequent TCP data into a composite buffer without bound, leading to unbounded memory allocation on the client and an out-of-memory crash. This occurs before authentication completes.
The impacted component is io.vertx:vertx-pg-client.
Weakness
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vert.x | Eclipse | 4.5.0 (including) | 4.5.35 (excluding) |
| Vert.x | Eclipse | 5.0.0 (including) | 5.1.10 (excluding) |
| Vert.x | Eclipse | 5.2.0 (including) | 5.2.0 (including) |