Memory Leak in Eclipse Vert.x TCP Servers
Summary
CVE-2024-1300: Eclipse Vert.x vulnerable to a memory leak in TCP servers. Affects io.vertx:vertx-core across 2 version ranges.
>= 4.3.4, < 4.4.8
>= 4.5.0, < 4.5.3
Fixed in 4.4.8 or 4.5.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Vert.x is a toolkit for building reactive applications on the Java Virtual Machine. It provides a high-performance event-driven architecture for creating scalable and resilient applications. One of its features is the ability to create TCP servers with Transport Layer Security (TLS) support. However, a vulnerability has been discovered in Vert.x that causes a memory leak in TCP servers configured with TLS and Server Name Indication (SNI) support.
Vulnerability Detail
The vulnerability occurs when processing an unknown SNI server name. Instead of assigning the mapped certificate, the server erroneously uses the default certificate and caches the SSL context in the server name map. This leads to memory exhaustion as the SSL contexts are not properly released. Attackers can exploit this flaw by sending TLS client hello messages with fake server names, triggering a JVM out-of-memory error. The vulnerability has a CVSS score of 5.3, indicating a moderate severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3.4, < 4.4.84.4.8 -
>= 4.5.0, < 4.5.34.5.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the recommended fix by upgrading the affected package to the fixed versions.
Conclusion
In conclusion, Eclipse Vert.x TCP servers configured with TLS and SNI support are vulnerable to a memory leak issue. Attackers can exploit this vulnerability to cause memory exhaustion and potentially disrupt the server's availability. It is crucial to upgrade to the fixed versions of the affected package and review the TLS server configuration to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.vertx:vertx-core →
FAQ
Eclipse Vert.x is a toolkit for building reactive applications on the Java Virtual Machine. It provides a high-performance event-driven architecture for creating scalable and resilient applications.
Transport Layer Security (TLS) is a cryptographic protocol used to secure communication over a network. Server Name Indication (SNI) is an extension of TLS that allows multiple SSL certificates to be served on the same IP address, enabling virtual hosting of multiple websites on a single server.
The vulnerability occurs when processing an unknown SNI server name. Instead of assigning the mapped certificate, the server erroneously uses the default certificate and caches the SSL context in the server name map, leading to memory exhaustion.
Attackers can exploit this vulnerability by sending TLS client hello messages with fake server names, triggering a JVM out-of-memory error. This can lead to denial-of-service attacks or disruption of service availability.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.vertx:vertx-core.
