Eclipse Vert.x DB2 Client Deserialization Flaw Enables Remote Code Execution

Eclipse Vert.x contains a critical security flaw in its DB2 client module that allows for remote code execution through unsafe deserialization of user-defined type data. The National Vulnerability Database assigned this issue CVE-2026-102469 and rated it with a CVSS score of 9.2, indicating a severe risk to applications using the affected library versions.

The vulnerability exists within the DRDA protocol handling code of the vertx-db2-client component, which processes database responses. When the client receives a result set containing a column tagged as a User Defined Type, it uses a bare ObjectInputStream.readObject() call to deserialize the data. This method lacks an ObjectInputFilter or a class allowlist, leaving the application exposed to malicious input during the deserialization process.

Technical Context

The specific code path is triggered when a DRDA server sends a response with a column identified by the FDOCA protocol LID 0x50. According to the source material, IBM DB2 does not support this type of User Defined Type, meaning legitimate DB2 servers never send data with this specific tag. However, a malicious actor or a man-in-the-middle attacker can craft a DRDA response that includes a 0x50-tagged column to exploit this unexpected behavior.

Because TLS is disabled by default in this component, man-in-the-middle attacks are feasible without additional configuration changes. The deserialization occurs on the Vert.x event loop before any application code has the opportunity to inspect or reject the incoming data. This timing allows an attacker to inject arbitrary bytes that the client will process immediately, bypassing standard application-level security checks.

Affected Versions

The vulnerability impacts a wide range of Eclipse Vert.x versions currently in use. Affected releases include versions 4.0.0 through 4.5.34, as well as versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and version 5.2.0. The specific component identified is io.vertx:vertx-db2-client. Organizations using any of these versions in their production environments are potentially exposed to this deserialization risk.

This discovery follows earlier reporting by Threat Times on October 14, 2026, regarding CVE-2026-102476, a critical flaw in the Eclipse Vert.x HTTP client that risks weak SSL contexts. That previous issue highlighted vulnerabilities in the HTTP client's security settings, whereas this new finding targets the database client's data handling mechanisms. Both issues underscore the need for rigorous security reviews within the Vert.x framework.

What should you do?

Security teams should immediately audit their applications for the presence of the io.vertx:vertx-db2-client component and verify the installed version against the affected list. If any affected versions are detected, teams should assess the exposure of their database connections, particularly whether TLS is enforced. Monitoring network traffic for unexpected DRDA responses with UDT tags can help detect potential exploitation attempts before they result in code execution.