Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx
Priority MEDIUM 62CWE-401Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service, Information disclosure
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 7 fixed, 9 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-401 and CWE-200.
Summary
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01653 76th percentileScored 2026-11-07
Fix Partial io.vertx:vertx-core (Maven): 4.5.2, 4.4.7Red Hat: 7 advisoriesRed Hat: 7 fixed, 9 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | vertx-core | 4.4.5; 4.4.6; 4.5.0; 4.5.1 | — | No fix listed | CNA |
| Red Hat | CEQ 3.2 | — | — | Not affected | CNA |
| Red Hat | Cryostat 2 on RHEL 8 | — | 2.4.0-7 | Patch available | CNA |
| Red Hat | Cryostat 2 on RHEL 8 | — | 2.4.0-4 | Patch available | CNA |
| Red Hat | Cryostat 2 on RHEL 8 | — | 2.4.0-4 | Patch available | CNA |
| Red Hat | Cryostat 2 on RHEL 8 | — | 2.4.0-4 | Patch available | CNA |
| Red Hat | Cryostat 2 on RHEL 8 | — | 2.4.0-9 | Patch available | CNA |
| Red Hat | Cryostat 2 on RHEL 8 | — | 2.4.0-4 | Patch available | CNA |
| Red Hat | MTA-6.2-RHEL-9 | — | 6.2.3-2 | Patch available | CNA |
| Red Hat | Red Hat AMQ Streams 2.7.0 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Quarkus 3.2.11.Final | — | 4.4.8.redhat-00001 | Patch available | CNA |
| Red Hat | RHINT Service Registry 2.5.11 GA | — | — | Not affected | CNA |
| Red Hat | A-MQ Clients 2 | — | — | Not affected | CNA |
| Red Hat | Migration Toolkit for Runtimes | — | — | No fix listed | CNA |
| Red Hat | OpenShift Serverless | — | — | Not affected | CNA |
| Red Hat | Red Hat AMQ Broker 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | — | — | No fix listed | CNA |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 3 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Build of Keycloak | — | — | No fix listed | CNA |
| Red Hat | Red Hat build of OptaPlanner 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat build of Quarkus | — | — | Not affected | CNA |
| Red Hat | Red Hat Data Grid 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Fuse 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Integration Camel K 1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Integration Camel Quarkus 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | Not affected | CNA |
| Red Hat | Red Hat Process Automation 7 | — | — | Not affected | CNA |
| — | io.vertx:vertx-core (Maven) | 4.5.0 to before 4.5.2 | 4.5.2 | Patch available | GHSA-5667-3wch-7q7w |
| — | io.vertx:vertx-core (Maven) | 4.4.5 to before 4.4.7 | 4.4.7 | Patch available | GHSA-5667-3wch-7q7w |
- vertx-core Vendor— Affected 4.4.5; 4.4.6; 4.5.0; 4.5.1 Fixed in — No fix listed CNA
- CEQ 3.2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Cryostat 2 on RHEL 8 VendorRed Hat Affected — Fixed in 2.4.0-7 Patch available CNA
- Cryostat 2 on RHEL 8 VendorRed Hat Affected — Fixed in 2.4.0-4 Patch available CNA
- Cryostat 2 on RHEL 8 VendorRed Hat Affected — Fixed in 2.4.0-4 Patch available CNA
- Cryostat 2 on RHEL 8 VendorRed Hat Affected — Fixed in 2.4.0-4 Patch available CNA
- Cryostat 2 on RHEL 8 VendorRed Hat Affected — Fixed in 2.4.0-9 Patch available CNA
- Cryostat 2 on RHEL 8 VendorRed Hat Affected — Fixed in 2.4.0-4 Patch available CNA
- MTA-6.2-RHEL-9 VendorRed Hat Affected — Fixed in 6.2.3-2 Patch available CNA
- Red Hat AMQ Streams 2.7.0 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Quarkus 3.2.11.Final VendorRed Hat Affected — Fixed in 4.4.8.redhat-00001 Patch available CNA
- RHINT Service Registry 2.5.11 GA VendorRed Hat Affected — Fixed in — Not affected CNA
- A-MQ Clients 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Migration Toolkit for Runtimes VendorRed Hat Affected — Fixed in — No fix listed CNA
- OpenShift Serverless VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat AMQ Broker 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apache Camel 4 for Quarkus 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat build of Apache Camel for Spring Boot 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Build of Keycloak VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat build of OptaPlanner 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Integration Camel K 1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Integration Camel Quarkus 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- io.vertx:vertx-core (Maven) Vendor— Affected 4.5.0 to before 4.5.2 Fixed in 4.5.2 Patch available GHSA-5667-3wch-7q7w
- io.vertx:vertx-core (Maven) Vendor— Affected 4.4.5 to before 4.4.7 Fixed in 4.4.7 Patch available GHSA-5667-3wch-7q7w
CPE names CNA · 26
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:apache_camel_quarkus:3.2 | 3.2 | — | Red Hat |
| cpe:/a:redhat:cryostat:2::el8 | 2 | — | Red Hat |
| cpe:/a:redhat:migration_toolkit_applications:6.2::el8 | 6.2 | — | Red Hat |
| cpe:/a:redhat:migration_toolkit_applications:6.2::el9 | 6.2 | — | Red Hat |
| cpe:/a:redhat:amq_streams:2 | 2 | — | Red Hat |
| cpe:/a:redhat:apache_camel_spring_boot:4.4::el6 | 4.4 | — | Red Hat |
| cpe:/a:redhat:quarkus:3.2 | 3.2 | — | Red Hat |
| cpe:/a:redhat:service_registry:2.5 | 2.5 | — | Red Hat |
| cpe:/a:redhat:a_mq_clients:2 | 2 | — | Red Hat |
| cpe:/a:redhat:migration_toolkit_runtimes:1 | 1 | — | Red Hat |
- cpe:/a:redhat:apache_camel_quarkus:3.2 Versions 3.2 — ·Red Hat
- cpe:/a:redhat:cryostat:2::el8 Versions 2 — ·Red Hat
- cpe:/a:redhat:migration_toolkit_applications:6.2::el8 Versions 6.2 — ·Red Hat
- cpe:/a:redhat:migration_toolkit_applications:6.2::el9 Versions 6.2 — ·Red Hat
- cpe:/a:redhat:amq_streams:2 Versions 2 — ·Red Hat
- cpe:/a:redhat:apache_camel_spring_boot:4.4::el6 Versions 4.4 — ·Red Hat
- cpe:/a:redhat:quarkus:3.2 Versions 3.2 — ·Red Hat
- cpe:/a:redhat:service_registry:2.5 Versions 2.5 — ·Red Hat
- cpe:/a:redhat:a_mq_clients:2 Versions 2 — ·Red Hat
- cpe:/a:redhat:migration_toolkit_runtimes:1 Versions 1 — ·Red Hat
Show 16 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:serverless:1 | 1 | — | Red Hat |
| cpe:/a:redhat:amq_broker:7 | 7 | — | Red Hat |
| cpe:/a:redhat:camel_quarkus:3 | 3 | — | Red Hat |
| cpe:/a:redhat:camel_spring_boot:3 | 3 | — | Red Hat |
| cpe:/a:redhat:build_keycloak: | — | — | Red Hat |
| cpe:/a:redhat:optaplanner:::el6 | — | — | Red Hat |
| cpe:/a:redhat:quarkus:2 | 2 | — | Red Hat |
| cpe:/a:redhat:jboss_data_grid:8 | 8 | — | Red Hat |
| cpe:/a:redhat:jboss_fuse:7 | 7 | — | Red Hat |
| cpe:/a:redhat:camel_k:1 | 1 | — | Red Hat |
| cpe:/a:redhat:camel_quarkus:2 | 2 | — | Red Hat |
| cpe:/a:redhat:jboss_data_grid:7 | 7 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7 | 7 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:8 | 8 | — | Red Hat |
| cpe:/a:redhat:jbosseapxp | — | — | Red Hat |
| cpe:/a:redhat:jboss_bpms:7 | 7 | — | Red Hat |
- cpe:/a:redhat:serverless:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:amq_broker:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:camel_quarkus:3 Versions 3 — ·Red Hat
- cpe:/a:redhat:camel_spring_boot:3 Versions 3 — ·Red Hat
- cpe:/a:redhat:build_keycloak: Versions — — ·Red Hat
- cpe:/a:redhat:optaplanner:::el6 Versions — — ·Red Hat
- cpe:/a:redhat:quarkus:2 Versions 2 — ·Red Hat
- cpe:/a:redhat:jboss_data_grid:8 Versions 8 — ·Red Hat
- cpe:/a:redhat:jboss_fuse:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:camel_k:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:camel_quarkus:2 Versions 2 — ·Red Hat
- cpe:/a:redhat:jboss_data_grid:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:8 Versions 8 — ·Red Hat
- cpe:/a:redhat:jbosseapxp Versions — — ·Red Hat
- cpe:/a:redhat:jboss_bpms:7 Versions 7 — ·Red Hat
Remediation
- Fix · GHSA-5667-3wch-7q7w io.vertx:vertx-core (Maven) Fixed in 4.5.2 Advisory →
- Fix · GHSA-5667-3wch-7q7w io.vertx:vertx-core (Maven) Fixed in 4.4.7 Advisory →
Red Hat 7 advisories
- RHSA-2024:4884 Released 2024-07-25 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.4.1 for Spring Boot security update.
- Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
- RHSA-2024:3989 Released 2024-06-20 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-ui-rhel9, mta/mta-windup-addon-rhel9
- RHSA-2024:3527 Released 2024-05-30 · Red Hat rating ModerateRed Hat AMQ Streams 2.7.0 release and security update
- Red Hat AMQ Streams 2.7.0
Show 4 more Red Hat advisories
- RHSA-2024:2833 Released 2024-05-14 · Red Hat rating ModerateService Registry (container images) release and security update [2.5.11 GA]
- RHINT Service Registry 2.5.11 GA
- RHSA-2024:2088 Released 2024-04-29 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
- RHSA-2024:1706 Released 2024-04-09 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.0 for Quarkus 3.2 is now available (updates to RHBQ 3.2.11)
- CEQ 3.2
- RHSA-2024:1662 Released 2024-04-03 · Red Hat rating ImportantRed Hat build of Quarkus 3.2.11 release and security update
- Red Hat build of Quarkus 3.2.11.Final io.quarkus.quarkus-kubernetes-deployment-3.2.11.Final-redhat-00001.jar, io.quarkus.quarkus-resteasy-reactive-3.2.11.Final-redhat-00001.jar, io.vertx.vertx-core-4.4.8.redhat-00001.jar +2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat A-MQ Clients 2, CEQ 3.2 and 22 more products — RHSA-2024:1706
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-01210 Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni supportPriority LOW 27
- Advisory ·
Red Hat A-MQ Clients 2, CEQ 3.2 and 22 more products — RHSA-2024:2088
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-01210 Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni supportPriority LOW 27
Show 1 more group
- Advisory ·
Red Hat A-MQ Clients 2, CEQ 3.2 and 22 more products — RHSA-2024:2833
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-01210 Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni supportPriority LOW 27
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Runtimes | Affected | No fix yet |
| Red Hat Build of Keycloak | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix yet |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel Quarkus 2 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix planned: Will not fix |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| CEQ 3.2 | Fixed | RHSA-2024:1706 |
| Cryostat 2 on RHEL 8 | Fixed | RHSA-2024:2088 |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2024:3989 |
| RHINT Service Registry 2.5.11 GA | Fixed | RHSA-2024:2833 |
| Red Hat AMQ Streams 2.7.0 | Fixed | RHSA-2024:3527 |
| Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 | Fixed | RHSA-2024:4884 |
| Red Hat build of Quarkus 3.2.11.Final | Fixed | RHSA-2024:1662 |
Not affected: 11 products
- A-MQ Clients 2
- MTA 6.2 for RHEL 8
- OpenShift Serverless
- Red Hat AMQ Broker 7
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Process Automation 7
- Red Hat build of Quarkus
- Red Hat build of Quarkus 3.2.11.Final
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1023
- 2026-10-03 Alias added: GHSA-5667-3wch-7q7w
References
Advisory 8
Other 8
- https://access.redhat.com/security/cve/CVE-2024-1023
- RHBZ#2260840
- https://github.com/eclipse-vertx/vert.x/issues/5078
- https://github.com/eclipse-vertx/vert.x/pull/5080
- https://github.com/eclipse-vertx/vert.x/pull/5082
- https://github.com/eclipse-vertx/vert.x/commit/665ceba38444e3929bb7b9a2a0bae2cb603fe81b
- https://github.com/eclipse-vertx/vert.x/commit/dd6f64302b56cd4d3dcf61efaaf174b5f6ce676d
- https://github.com/eclipse-vertx/vert.x
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-1023 · CVE Program
- CVE-2024-1023 · NVD
- FIRST EPSS
- GHSA-5667-3wch-7q7w · GitHub Advisory Database · CC BY 4.0
- CVE-2024-1023 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences