We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-1023

Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx



Description

A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.

Reserved 2024-01-29 | Published 2024-03-27 | Updated 2025-06-24 | Assigner redhat


MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem types

Missing Release of Memory after Effective Lifetime

Product status

Default status
unaffected

4.4.5
affected

4.4.6
affected

4.5.0
affected

4.5.1
affected

Default status
unaffected

Default status
affected

2.4.0-7 before *
unaffected

Default status
affected

2.4.0-4 before *
unaffected

Default status
affected

2.4.0-4 before *
unaffected

Default status
affected

2.4.0-4 before *
unaffected

Default status
affected

2.4.0-9 before *
unaffected

Default status
affected

2.4.0-4 before *
unaffected

Default status
affected

6.2.3-2 before *
unaffected

Default status
unaffected

Default status
unaffected

Default status
affected

4.4.8.redhat-00001 before *
unaffected

Default status
unaffected

Default status
unaffected

Default status
affected

Default status
unaffected

Default status
unaffected

Default status
affected

Default status
affected

Default status
affected

Default status
unaffected

Default status
affected

Default status
unaffected

Default status
affected

Default status
affected

Default status
affected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Timeline

2024-01-29:Reported to Red Hat.
2024-01-26:Made public.

References

access.redhat.com/errata/RHSA-2024:1662 (RHSA-2024:1662) vendor-advisory

access.redhat.com/errata/RHSA-2024:1706 (RHSA-2024:1706) vendor-advisory

access.redhat.com/errata/RHSA-2024:2088 (RHSA-2024:2088) vendor-advisory

access.redhat.com/errata/RHSA-2024:2833 (RHSA-2024:2833) vendor-advisory

access.redhat.com/errata/RHSA-2024:3527 (RHSA-2024:3527) vendor-advisory

access.redhat.com/errata/RHSA-2024:3989 (RHSA-2024:3989) vendor-advisory

access.redhat.com/errata/RHSA-2024:4884 (RHSA-2024:4884) vendor-advisory

access.redhat.com/security/cve/CVE-2024-1023 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2260840 (RHBZ#2260840) issue-tracking

github.com/eclipse-vertx/vert.x/issues/5078

github.com/eclipse-vertx/vert.x/pull/5080

github.com/eclipse-vertx/vert.x/pull/5082

cve.org (CVE-2024-1023)

nvd.nist.gov (CVE-2024-1023)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2024-1023

Support options

Helpdesk Chat, Email, Knowledgebase