Log in Start free

Vulnerability · Published Mar 27, 2024 · Assigned by redhat

CVE-2024-1023Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx

Medium 6.5

In plain English

A medium-severity memory leak in vertx-core. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.7%top 23.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenio.vertx:vertx-core4.5.2GHSA-5667-3wch-7q7w
Mavenio.vertx:vertx-core4.4.7GHSA-5667-3wch-7q7w

Affected products (as reported)

VendorProductVersions
vertx-core 4.4.54.4.64.5.04.5.1
Red Hat CEQ 3.2 see references
Red Hat Cryostat 2 on RHEL 8 see references
Red Hat Cryostat 2 on RHEL 8 see references
Red Hat Cryostat 2 on RHEL 8 see references
Red Hat Cryostat 2 on RHEL 8 see references
Red Hat Cryostat 2 on RHEL 8 see references
Red Hat Cryostat 2 on RHEL 8 see references
Red Hat MTA-6.2-RHEL-9 see references
Red Hat Red Hat AMQ Streams 2.7.0 see references
Red Hat Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 see references
Red Hat Red Hat build of Quarkus 3.2.11.Final see references
Red Hat RHINT Service Registry 2.5.11 GA see references
Red Hat A-MQ Clients 2 see references
Red Hat Migration Toolkit for Runtimes see references
Red Hat OpenShift Serverless see references
Red Hat Red Hat AMQ Broker 7 see references
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 see references
Red Hat Red Hat build of Apache Camel for Spring Boot 3 see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat build of OptaPlanner 8 see references
Red Hat Red Hat build of Quarkus see references
Red Hat Red Hat Data Grid 8 see references
Red Hat Red Hat Fuse 7 see references
Red Hat Red Hat Integration Camel K 1 see references
Red Hat Red Hat Integration Camel Quarkus 2 see references
Red Hat Red Hat JBoss Data Grid 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack see references

Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References