Skip to content
Fencer Vulns
medium 6.5

CVE-2024-1023 json

Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx

published 2024-03-27 2 y ago modified 2026-11-05 4 d ago also GHSA-5667-3wch-7q7w , EUVD-2024-0823

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.

Patch / fix

  • maven io.vertx:vertx-core 4.4.7, 4.5.2
  • Red Hat Cryostat 2 on RHEL 8 2.4.0-4, 2.4.0-7, 2.4.0-9
  • Red Hat MTA-6.2-RHEL-9 6.2.3-2
  • Red Hat Red Hat build of Quarkus 3.2.11.Final 4.4.8.redhat-00001

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-1023 updated cvss 6.5

io.vertx/vertx-core: memory leak due to the use of Netty FastThreadLocal data structures in Vertx

  • Red Hat Migration Toolkit for Runtimes vert.x Red Hat build of Apache Camel 4 for Quarkus 3 vert.x vert.x
    affected: workaround, no fix available
  • Red Hat build of Apache Camel for Spring Boot 3 vert.x vert.x
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Build of Keycloak vert.x vert.x
    affected: workaround, no fix available
  • Red Hat build of OptaPlanner 8 vert.x vert.x
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Data Grid 8 vert.x vert.x
    affected: workaround, no fix available
  • Red Hat Integration Camel K 1 vert.x vert.x Red Hat Integration Camel Quarkus 2 vert.x vert.x Red Hat JBoss Data Grid 7 vert.x vert.x
    affected: workaround, no fix planned “Will not fix”
  • Red Hat CEQ 3.2
    fixed: vendor fix RHSA-2024:1706
  • Red Hat Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-rhel8 2.4.0-4, cryostat-tech-preview/jfr-datasource-rhel8 2.4.0-4, cryostat-tech-preview/cryostat-reports-rhel8 2.4.0-4, cryostat-tech-preview/cryostat-rhel8-operator 2.4.0-9, cryostat-tech-preview/cryostat-operator-bundle 2.4.0-4, cryostat-tech-preview/cryostat-grafana-dashboard-rhel8 2.4.0-7
    fixed: vendor fix RHSA-2024:2088
show 6 more
  • Red Hat MTA 6.2 for RHEL 8 mta/mta-windup-addon-rhel9 6.2.3-2
    fixed: vendor fix RHSA-2024:3989
  • Red Hat AMQ Streams 2.7.0
    fixed: vendor fix RHSA-2024:3527
  • Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
    fixed: vendor fix RHSA-2024:4884
  • Red Hat build of Quarkus 3.2.11.Final vertx-core 4.4.8.redhat-00001
    fixed: vendor fix RHSA-2024:1662
  • Red Hat RHINT Service Registry 2.5.11 GA
    fixed: vendor fix RHSA-2024:2833
  • Red Hat A-MQ Clients 2 vert.x vert.x Red Hat MTA 6.2 for RHEL 8 mta/mta-ui-rhel9 6.2.3-2, mta/mta-hub-rhel9 6.2.3-1, mta/mta-rhel8-operator 6.2.3-1, mta/mta-operator-bundle 6.2.3-4, mta/mta-pathfinder-rhel9 6.2.3-1 Red Hat OpenShift Serverless vert.x vert.x Red Hat AMQ Broker 7 vert.x vert.x Red Hat build of Quarkus vertx-core Red Hat build of Quarkus 3.2.11.Final jna 5.8.0, lit 2.7.4, bson 4.9.1, db2 1.18.3, h2 2.2.220, jdom 1.1.3, +1046 more
    +5 more products
    Red Hat Fuse 7 vert.x vert.x Red Hat JBoss Enterprise Application Platform 7 vert.x vert.x Red Hat JBoss Enterprise Application Platform 8 vert.x vert.x Red Hat JBoss Enterprise Application Platform Expansion Pack vert.x vert.x Red Hat Process Automation 7 vert.x vert.x
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.65% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven io.vertx:vertx-core
>=4.5.0, <4.5.2
>=4.4.5, <4.4.7
4.5.2
4.4.7

Affected products

  • Red Hat CEQ 3.2
  • Red Hat Cryostat 2 on RHEL 8
  • Red Hat MTA-6.2-RHEL-9
  • Red Hat Red Hat AMQ Streams 2.7.0
  • Red Hat Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
  • Red Hat Red Hat build of Quarkus 3.2.11.Final
  • Red Hat RHINT Service Registry 2.5.11 GA
  • Red Hat A-MQ Clients 2
  • Red Hat Migration Toolkit for Runtimes
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat AMQ Broker 7
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat build of OptaPlanner 8
  • Red Hat Red Hat build of Quarkus
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat Integration Camel K 1
  • Red Hat Red Hat Integration Camel Quarkus 2
  • Red Hat Red Hat JBoss Data Grid 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Process Automation 7

Classification

Weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.