Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2024-1023

Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

vertx-core

Default version status: unaffected

  • 4.4.5affected
  • 4.4.6affected
  • 4.5.0affected
  • 4.5.1affected

Red Hat CEQ 3.2

Default version status: unaffected

Red Hat Cryostat 2 on RHEL 8

Default version status: affected

  • 2.4.0-7 to < *unaffected

Red Hat Cryostat 2 on RHEL 8

Default version status: affected

  • 2.4.0-4 to < *unaffected

Red Hat Cryostat 2 on RHEL 8

Default version status: affected

  • 2.4.0-4 to < *unaffected

Red Hat Cryostat 2 on RHEL 8

Default version status: affected

  • 2.4.0-4 to < *unaffected

Red Hat Cryostat 2 on RHEL 8

Default version status: affected

  • 2.4.0-9 to < *unaffected

Red Hat Cryostat 2 on RHEL 8

Default version status: affected

  • 2.4.0-4 to < *unaffected

Red Hat MTA-6.2-RHEL-9

Default version status: affected

  • 6.2.3-2 to < *unaffected

Red Hat Red Hat AMQ Streams 2.7.0

Default version status: unaffected

Red Hat Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2

Default version status: unaffected

Red Hat Red Hat build of Quarkus 3.2.11.Final

Default version status: affected

  • 4.4.8.redhat-00001 to < *unaffected

Red Hat RHINT Service Registry 2.5.11 GA

Default version status: unaffected

Red Hat A-MQ Clients 2

Default version status: unaffected

Red Hat Migration Toolkit for Runtimes

Default version status: affected

Red Hat OpenShift Serverless

Default version status: unaffected

Red Hat Red Hat AMQ Broker 7

Default version status: unaffected

Red Hat Red Hat build of Apache Camel 4 for Quarkus 3

Default version status: affected

Red Hat Red Hat build of Apache Camel for Spring Boot 3

Default version status: affected

Red Hat Red Hat Build of Keycloak

Default version status: affected

Red Hat Red Hat build of OptaPlanner 8

Default version status: affected

Red Hat Red Hat build of Quarkus

Default version status: unaffected

Red Hat Red Hat Data Grid 8

Default version status: affected

Red Hat Red Hat Fuse 7

Default version status: unaffected

Red Hat Red Hat Integration Camel K 1

Default version status: affected

Red Hat Red Hat Integration Camel Quarkus 2

Default version status: affected

Red Hat Red Hat JBoss Data Grid 7

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform 7

Default version status: unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8

Default version status: unaffected

Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Default version status: unaffected

Red Hat Red Hat Process Automation 7

Default version status: unaffected

References