CVE-2024-1023 — Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx

Description (CNA)

A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	affected 4.4.5; affected 4.4.6; affected 4.5.0; affected 4.5.1
Red Hat / CEQ 3.2	unaffected
Red Hat / Cryostat 2 on RHEL 8	unaffected 2.4.0-7 before *
Red Hat / Cryostat 2 on RHEL 8	unaffected 2.4.0-4 before *
Red Hat / Cryostat 2 on RHEL 8	unaffected 2.4.0-4 before *
Red Hat / Cryostat 2 on RHEL 8	unaffected 2.4.0-4 before *
Red Hat / Cryostat 2 on RHEL 8	unaffected 2.4.0-9 before *
Red Hat / Cryostat 2 on RHEL 8	unaffected 2.4.0-4 before *
Red Hat / MTA-6.2-RHEL-9	unaffected 6.2.3-2 before *
Red Hat / Red Hat AMQ Streams 2.7.0	unaffected
Red Hat / Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2	unaffected
Red Hat / Red Hat build of Quarkus 3.2.11.Final	unaffected 4.4.8.redhat-00001 before *
Red Hat / RHINT Service Registry 2.5.11 GA	unaffected
Red Hat / A-MQ Clients 2	unaffected
Red Hat / Migration Toolkit for Runtimes	affected
Red Hat / OpenShift Serverless	unaffected
Red Hat / Red Hat AMQ Broker 7	unaffected
Red Hat / Red Hat build of Apache Camel 4 for Quarkus 3	affected
Red Hat / Red Hat build of Apache Camel for Spring Boot 3	affected
Red Hat / Red Hat Build of Keycloak	affected
Red Hat / Red Hat build of OptaPlanner 8	affected
Red Hat / Red Hat build of Quarkus	unaffected
Red Hat / Red Hat Data Grid 8	affected
Red Hat / Red Hat Fuse 7	unaffected
Red Hat / Red Hat Integration Camel K 1	affected
Red Hat / Red Hat Integration Camel Quarkus 2	affected
Red Hat / Red Hat JBoss Data Grid 7	affected
Red Hat / Red Hat JBoss Enterprise Application Platform 7	unaffected
Red Hat / Red Hat JBoss Enterprise Application Platform 8	unaffected
Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Pack	unaffected
Red Hat / Red Hat Process Automation 7	unaffected

CWE

CWE-401

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.