Medium severity · published Apr 2, 2024
CVE-2024-1300
Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support
5.4
CVSS
1.1%
EPSS
No
On KEV
Description
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C2
Cryostat 2 on RHEL 8 · Red Hat
All versions, or not specified · source: vendor
MT
MTA-6.2-RHEL-9 · Red Hat
All versions, or not specified · source: vendor
MT
Migration Toolkit for Runtimes 1 on RHEL 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Build of Keycloak · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Integration Camel K 1 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Integration Camel Quarkus 2 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Data Grid 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Process Automation 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Apache Camel 4 for Quarkus 3 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Apache Camel for Spring Boot 3 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of OptaPlanner 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Quarkus · Red Hat
All versions, or not specified · source: vendor