Read the docs
TI-2024-01210 Aliases CVE-2024-1300GHSA-9ph3-v2vh-3qx7

Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support

Priority LOW 27CWE-772Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
Low · None · Low
Fix status
Partial Red Hat: 8 fixed, 9 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-772.

Summary

A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01064 64th percentileScored 2026-11-07
Fix Partial io.vertx:vertx-core (Maven): 4.4.8, 4.5.3Red Hat: 8 advisoriesRed Hat: 8 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—io.vertx:vertx-core4.3.4 – 4.5.2—No fix listedCNA
Red HatCEQ 3.2——Not affectedCNA
Red HatCryostat 2 on RHEL 8—2.4.0-7Patch availableCNA
Red HatCryostat 2 on RHEL 8—2.4.0-4Patch availableCNA
Red HatCryostat 2 on RHEL 8—2.4.0-4Patch availableCNA
Red HatCryostat 2 on RHEL 8—2.4.0-4Patch availableCNA
Red HatCryostat 2 on RHEL 8—2.4.0-9Patch availableCNA
Red HatCryostat 2 on RHEL 8—2.4.0-4Patch availableCNA
Red HatMigration Toolkit for Runtimes 1 on RHEL 8—1.2-18Patch availableCNA
Red HatMigration Toolkit for Runtimes 1 on RHEL 8—1.2-11Patch availableCNA
Red HatMigration Toolkit for Runtimes 1 on RHEL 8—1.2-12Patch availableCNA
Red HatMigration Toolkit for Runtimes 1 on RHEL 8—1.2-10Patch availableCNA
Red HatMTA-6.2-RHEL-9—6.2.3-2Patch availableCNA
Red HatRed Hat AMQ Streams 2.7.0——Not affectedCNA
Red HatRed Hat build of Apache Camel 4.4.1 for Spring Boot 3.2——Not affectedCNA
Red HatRed Hat build of Quarkus 3.2.11.Final—4.4.8.redhat-00001Patch availableCNA
Red HatRHINT Service Registry 2.5.11 GA——Not affectedCNA
Red HatA-MQ Clients 2——Not affectedCNA
Red HatOpenShift Serverless——Not affectedCNA
Red HatRed Hat AMQ Broker 7——Not affectedCNA
Red HatRed Hat build of Apache Camel 4 for Quarkus 3——No fix listedCNA
Red HatRed Hat build of Apache Camel for Spring Boot 3——No fix listedCNA
Red HatRed Hat Build of Keycloak——No fix listedCNA
Red HatRed Hat build of OptaPlanner 8——No fix listedCNA
Red HatRed Hat build of Quarkus——No fix listedCNA
Red HatRed Hat Data Grid 8——Not affectedCNA
Red HatRed Hat Fuse 7——Not affectedCNA
Red HatRed Hat Integration Camel K 1——No fix listedCNA
Red HatRed Hat Integration Camel Quarkus 2——No fix listedCNA
Red HatRed Hat JBoss Data Grid 7——No fix listedCNA
Red HatRed Hat JBoss Enterprise Application Platform 7——Not affectedCNA
Red HatRed Hat JBoss Enterprise Application Platform 8——Not affectedCNA
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack——Not affectedCNA
Red HatRed Hat Process Automation 7——No fix listedCNA
—io.vertx:vertx-core (Maven)4.3.4 to before 4.4.84.4.8Patch availableGHSA-9ph3-v2vh-3qx7
—io.vertx:vertx-core (Maven)4.5.0 to before 4.5.34.5.3Patch availableGHSA-9ph3-v2vh-3qx7
  • io.vertx:vertx-core Vendor— Affected 4.3.4 – 4.5.2 Fixed in — No fix listed CNA
  • CEQ 3.2 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Cryostat 2 on RHEL 8 VendorRed Hat Affected — Fixed in 2.4.0-7 Patch available CNA
  • Cryostat 2 on RHEL 8 VendorRed Hat Affected — Fixed in 2.4.0-4 Patch available CNA
  • Cryostat 2 on RHEL 8 VendorRed Hat Affected — Fixed in 2.4.0-4 Patch available CNA
  • Cryostat 2 on RHEL 8 VendorRed Hat Affected — Fixed in 2.4.0-4 Patch available CNA
  • Cryostat 2 on RHEL 8 VendorRed Hat Affected — Fixed in 2.4.0-9 Patch available CNA
  • Cryostat 2 on RHEL 8 VendorRed Hat Affected — Fixed in 2.4.0-4 Patch available CNA
  • Migration Toolkit for Runtimes 1 on RHEL 8 VendorRed Hat Affected — Fixed in 1.2-18 Patch available CNA
  • Migration Toolkit for Runtimes 1 on RHEL 8 VendorRed Hat Affected — Fixed in 1.2-11 Patch available CNA
  • Migration Toolkit for Runtimes 1 on RHEL 8 VendorRed Hat Affected — Fixed in 1.2-12 Patch available CNA
  • Migration Toolkit for Runtimes 1 on RHEL 8 VendorRed Hat Affected — Fixed in 1.2-10 Patch available CNA
  • MTA-6.2-RHEL-9 VendorRed Hat Affected — Fixed in 6.2.3-2 Patch available CNA
  • Red Hat AMQ Streams 2.7.0 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Quarkus 3.2.11.Final VendorRed Hat Affected — Fixed in 4.4.8.redhat-00001 Patch available CNA
  • RHINT Service Registry 2.5.11 GA VendorRed Hat Affected — Fixed in — Not affected CNA
  • A-MQ Clients 2 VendorRed Hat Affected — Fixed in — Not affected CNA
  • OpenShift Serverless VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat AMQ Broker 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Apache Camel 4 for Quarkus 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat build of Apache Camel for Spring Boot 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Build of Keycloak VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat build of OptaPlanner 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Integration Camel K 1 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Integration Camel Quarkus 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • io.vertx:vertx-core (Maven) Vendor— Affected 4.3.4 to before 4.4.8 Fixed in 4.4.8 Patch available GHSA-9ph3-v2vh-3qx7
  • io.vertx:vertx-core (Maven) Vendor— Affected 4.5.0 to before 4.5.3 Fixed in 4.5.3 Patch available GHSA-9ph3-v2vh-3qx7

CPE names CNA · 26

CPEVersionsRoleVendor
cpe:/a:redhat:apache_camel_quarkus:3.23.2—Red Hat
cpe:/a:redhat:cryostat:2::el82—Red Hat
cpe:/a:redhat:migration_toolkit_runtimes:1.0::el81.0—Red Hat
cpe:/a:redhat:migration_toolkit_applications:6.2::el86.2—Red Hat
cpe:/a:redhat:migration_toolkit_applications:6.2::el96.2—Red Hat
cpe:/a:redhat:amq_streams:22—Red Hat
cpe:/a:redhat:apache_camel_spring_boot:4.4::el64.4—Red Hat
cpe:/a:redhat:quarkus:3.23.2—Red Hat
cpe:/a:redhat:service_registry:2.52.5—Red Hat
cpe:/a:redhat:a_mq_clients:22—Red Hat
  • cpe:/a:redhat:apache_camel_quarkus:3.2 Versions 3.2 — ·Red Hat
  • cpe:/a:redhat:cryostat:2::el8 Versions 2 — ·Red Hat
  • cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8 Versions 1.0 — ·Red Hat
  • cpe:/a:redhat:migration_toolkit_applications:6.2::el8 Versions 6.2 — ·Red Hat
  • cpe:/a:redhat:migration_toolkit_applications:6.2::el9 Versions 6.2 — ·Red Hat
  • cpe:/a:redhat:amq_streams:2 Versions 2 — ·Red Hat
  • cpe:/a:redhat:apache_camel_spring_boot:4.4::el6 Versions 4.4 — ·Red Hat
  • cpe:/a:redhat:quarkus:3.2 Versions 3.2 — ·Red Hat
  • cpe:/a:redhat:service_registry:2.5 Versions 2.5 — ·Red Hat
  • cpe:/a:redhat:a_mq_clients:2 Versions 2 — ·Red Hat
Show 16 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:serverless:11—Red Hat
cpe:/a:redhat:amq_broker:77—Red Hat
cpe:/a:redhat:camel_quarkus:33—Red Hat
cpe:/a:redhat:camel_spring_boot:33—Red Hat
cpe:/a:redhat:build_keycloak:——Red Hat
cpe:/a:redhat:optaplanner:::el6——Red Hat
cpe:/a:redhat:quarkus:22—Red Hat
cpe:/a:redhat:jboss_data_grid:88—Red Hat
cpe:/a:redhat:jboss_fuse:77—Red Hat
cpe:/a:redhat:camel_k:11—Red Hat
cpe:/a:redhat:camel_quarkus:22—Red Hat
cpe:/a:redhat:jboss_data_grid:77—Red Hat
cpe:/a:redhat:jboss_enterprise_application_platform:77—Red Hat
cpe:/a:redhat:jboss_enterprise_application_platform:88—Red Hat
cpe:/a:redhat:jbosseapxp——Red Hat
cpe:/a:redhat:jboss_bpms:77—Red Hat
  • cpe:/a:redhat:serverless:1 Versions 1 — ·Red Hat
  • cpe:/a:redhat:amq_broker:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:camel_quarkus:3 Versions 3 — ·Red Hat
  • cpe:/a:redhat:camel_spring_boot:3 Versions 3 — ·Red Hat
  • cpe:/a:redhat:build_keycloak: Versions — — ·Red Hat
  • cpe:/a:redhat:optaplanner:::el6 Versions — — ·Red Hat
  • cpe:/a:redhat:quarkus:2 Versions 2 — ·Red Hat
  • cpe:/a:redhat:jboss_data_grid:8 Versions 8 — ·Red Hat
  • cpe:/a:redhat:jboss_fuse:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:camel_k:1 Versions 1 — ·Red Hat
  • cpe:/a:redhat:camel_quarkus:2 Versions 2 — ·Red Hat
  • cpe:/a:redhat:jboss_data_grid:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:jboss_enterprise_application_platform:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:jboss_enterprise_application_platform:8 Versions 8 — ·Red Hat
  • cpe:/a:redhat:jbosseapxp Versions — — ·Red Hat
  • cpe:/a:redhat:jboss_bpms:7 Versions 7 — ·Red Hat

Remediation

  • Fix · GHSA-9ph3-v2vh-3qx7 io.vertx:vertx-core (Maven) Fixed in 4.4.8 Advisory →
  • Fix · GHSA-9ph3-v2vh-3qx7 io.vertx:vertx-core (Maven) Fixed in 4.5.3 Advisory →

Red Hat 8 advisories

  • RHSA-2024:4884 Released 2024-07-25 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.4.1 for Spring Boot security update.
    • Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
  • RHSA-2024:3989 Released 2024-06-20 · Red Hat rating Important
    Migration Toolkit for Applications security and bug fix update
    • MTA 6.2 for RHEL 8 mta/mta-ui-rhel9, mta/mta-windup-addon-rhel9
  • RHSA-2024:3527 Released 2024-05-30 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.7.0 release and security update
    • Red Hat AMQ Streams 2.7.0
Show 5 more Red Hat advisories
  • RHSA-2024:2833 Released 2024-05-14 · Red Hat rating Moderate
    Service Registry (container images) release and security update [2.5.11 GA]
    • RHINT Service Registry 2.5.11 GA
  • RHSA-2024:2088 Released 2024-04-29 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
  • RHSA-2024:1923 Released 2024-04-18 · Red Hat rating Moderate
    Migration Toolkit for Runtimes security, bug fix and enhancement update
    • Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-operator-bundle, mtr/mtr-rhel8-operator, mtr/mtr-web-container-rhel8 +1
  • RHSA-2024:1706 Released 2024-04-09 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.0 for Quarkus 3.2 is now available (updates to RHBQ 3.2.11)
    • CEQ 3.2
  • RHSA-2024:1662 Released 2024-04-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.2.11 release and security update
    • Red Hat build of Quarkus 3.2.11.Final io.quarkus.quarkus-kubernetes-deployment-3.2.11.Final-redhat-00001.jar, io.quarkus.quarkus-resteasy-reactive-3.2.11.Final-redhat-00001.jar, io.vertx.vertx-core-4.4.8.redhat-00001.jar +2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat A-MQ Clients 2, CEQ 3.2 and 22 more products — RHSA-2024:1706

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-00946 Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxPriority MEDIUM 62
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat A-MQ Clients 2, CEQ 3.2 and 22 more products — RHSA-2024:2088

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-00946 Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxPriority MEDIUM 62
    Show all 2 records → Advisory →
Show 1 more group
  • Advisory ·

    Red Hat A-MQ Clients 2, CEQ 3.2 and 22 more products — RHSA-2024:2833

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-00946 Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxPriority MEDIUM 62
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of KeycloakAffectedNo fix yet
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat Integration Camel Quarkus 2AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 3AffectedNo fix planned: Will not fix
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
Red Hat build of QuarkusAffectedNo fix planned: Will not fix
CEQ 3.2Fixed RHSA-2024:1706
Cryostat 2 on RHEL 8Fixed RHSA-2024:2088
MTA 6.2 for RHEL 8Fixed RHSA-2024:3989
Migration Toolkit for Runtimes 1 on RHEL 8Fixed RHSA-2024:1923
RHINT Service Registry 2.5.11 GAFixed RHSA-2024:2833
Red Hat AMQ Streams 2.7.0Fixed RHSA-2024:3527
Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2Fixed RHSA-2024:4884
Red Hat build of Quarkus 3.2.11.FinalFixed RHSA-2024:1662
Not affected: 10 products
  • A-MQ Clients 2
  • MTA 6.2 for RHEL 8
  • OpenShift Serverless
  • Red Hat AMQ Broker 7
  • Red Hat Data Grid 8
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat build of Quarkus 3.2.11.Final

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1300
  2. 2026-10-03 Alias added: GHSA-9ph3-v2vh-3qx7

References

Advisory 9

Other 9

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7412 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences