GHSA-5667-3wch-7q7w
Eclipse Vert.x memory leak
At a glance
- Published
- Updated
- CVE
- CVE-2024-1023
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Description
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
Affected packages
| Package | Versions |
|---|---|
| Maven · io.vertx:vertx-core | introduced 4.5.0, fixed 4.5.2 |
| Maven · io.vertx:vertx-core | introduced 4.4.5, fixed 4.4.7 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-1023 ADVISORY
- https://github.com/eclipse-vertx/vert.x/issues/5078 WEB
- https://github.com/eclipse-vertx/vert.x/pull/5080 WEB
- https://github.com/eclipse-vertx/vert.x/pull/5082 WEB
- https://github.com/eclipse-vertx/vert.x/commit/665ceba38444e3929bb7b9a2a0bae2cb603fe81b WEB
- https://github.com/eclipse-vertx/vert.x/commit/dd6f64302b56cd4d3dcf61efaaf174b5f6ce676d WEB
- https://access.redhat.com/errata/RHSA-2024:1662 WEB
- https://access.redhat.com/errata/RHSA-2024:1706 WEB
- https://access.redhat.com/errata/RHSA-2024:2088 WEB
- https://access.redhat.com/errata/RHSA-2024:2833 WEB
- https://access.redhat.com/errata/RHSA-2024:3527 WEB
- https://access.redhat.com/errata/RHSA-2024:3989 WEB
- https://access.redhat.com/errata/RHSA-2024:4884 WEB
- https://access.redhat.com/security/cve/CVE-2024-1023 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2260840 WEB
- https://github.com/eclipse-vertx/vert.x PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |