title: Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx
description: A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
problem types: Improper Restriction of Operations within the Bounds of a Memory Buffer
affected:
{
product: vertx
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: CEQ 3.2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
defaultStatus: unaffected
packageName: vert.x
cpe: cpe:/a:redhat:camel_quarkus:3
}
{
vendor: Red Hat
product: Red Hat build of Quarkus 3.2.11.Final
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: io.vertx/vertx-core
defaultStatus: affected
versions:
version: 4.4.8.redhat-00001, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:quarkus:3.2::el8
}
{
vendor: Red Hat
product: A-MQ Clients 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:a_mq_clients:2
}
{
vendor: Red Hat
product: Cryostat 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:cryostat:2
}
{
vendor: Red Hat
product: Migration Toolkit for Applications 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: affected
cpes: cpe:/a:redhat:migration_toolkit_applications:6
}
{
vendor: Red Hat
product: Migration Toolkit for Runtimes
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: affected
cpes: cpe:/a:redhat:migration_toolkit_runtimes:1
}
{
vendor: Red Hat
product: OpenShift Serverless
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:serverless:1
}
{
vendor: Red Hat
product: Red Hat build of Apache Camel 4.0 for Spring Boot
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:camel_spring_boot:4
}
{
vendor: Red Hat
product: Red Hat build of Apache Camel for Spring Boot
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:camel_spring_boot:3
}
{
vendor: Red Hat
product: Red Hat Build of Keycloak
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:build_keycloak:22
}
{
vendor: Red Hat
product: Red Hat build of OptaPlanner 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:optaplanner:::el6
}
{
vendor: Red Hat
product: Red Hat build of Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: io.vertx/vertx-core
defaultStatus: unaffected
cpes: cpe:/a:redhat:quarkus:2
}
{
vendor: Red Hat
product: Red Hat Data Grid 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_data_grid:8
}
{
vendor: Red Hat
product: Red Hat Integration Camel K
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:integration:1
}
{
vendor: Red Hat
product: Red Hat Integration Camel Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:camel_quarkus:2
}
{
vendor: Red Hat
product: Red Hat Integration Service Registry
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:service_registry:2
}
{
vendor: Red Hat
product: Red Hat JBoss A-MQ 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:amq_broker:7
}
{
vendor: Red Hat
product: Red Hat JBoss A-MQ Streams
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:amq_streams:1
}
{
vendor: Red Hat
product: Red Hat JBoss Data Grid 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_data_grid:7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vert.x
defaultStatus: unaffected
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vert.x
defaultStatus: unaffected
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vert.x
defaultStatus: unaffected
cpes: cpe:/a:redhat:jbosseapxp
}
{
vendor: Red Hat
product: Red Hat JBoss Fuse 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_fuse:7
}
{
vendor: Red Hat
product: Red Hat Process Automation 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vert.x
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]