CVE-2018-12541: Excessive memory allocation in io.vertx:vertx-core
Summary
CVE-2018-12541: Excessive memory allocation. Affects io.vertx:vertx-core versions >= 3.0.0, < 3.5.4. Fixed in 3.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The io.vertx:vertx-core package is a core component of Eclipse Vert.x, a toolkit for building reactive applications on the Java Virtual Machine. It provides a set of APIs for creating high-performance, scalable, and event-driven applications. This package is responsible for handling WebSocket HTTP upgrades. The vulnerability in versions 3.0.0 to 3.5.3 of the package allows for excessive memory allocation during the WebSocket handshake process, potentially leading to memory exhaustion and denial of service attacks.
Vulnerability Detail
The WebSocket HTTP upgrade implementation in io.vertx:vertx-core buffers the entire HTTP request before performing the handshake, which results in holding the complete request body in memory. This behavior can be exploited by an attacker to exhaust the available memory by sending large requests. To mitigate this vulnerability, a reasonable limit of 8192 bytes should be imposed, beyond which the WebSocket should respond with an HTTP 413 status code and close the connection. The impact of this vulnerability can range from service disruption to complete denial of service.
How To Fix
Minimum fixed version
3.5.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually setting a reasonable limit for the WebSocket request body size. This can be achieved by modifying the configuration or code responsible for handling WebSocket upgrades. Here is an example of how to set the limit to 8192 bytes in Java:
HttpServerOptions options = new HttpServerOptions().setMaxWebsocketFrameSize(8192);
Conclusion
The vulnerability in io.vertx:vertx-core versions 3.0.0 to 3.5.3 allows for excessive memory allocation during the WebSocket handshake process, potentially leading to denial of service attacks. To mitigate this vulnerability, it is recommended to upgrade to version 3.5.4 or later. If immediate upgrading is not feasible, a temporary workaround can be implemented by setting a reasonable limit for the WebSocket request body size. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.vertx:vertx-core →
FAQ
The vulnerability allows an attacker to exhaust the available memory by sending large WebSocket requests, potentially leading to denial of service attacks and service disruption.
Versions 3.0.0 to 3.5.3 of io.vertx:vertx-core are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it for open-source vulnerabilities, including this one.
Yes, upgrading to version 3.5.4 or later of io.vertx:vertx-core fixes this vulnerability. It is recommended to update to the latest version to ensure the security of your application.
If immediate upgrading is not possible, you can implement a temporary workaround by manually setting a reasonable limit for the WebSocket request body size. Refer to the 'workaround' section for more details.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.vertx:vertx-core.
