title: Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support
description: A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
problem types: Uncontrolled Resource Consumption
affected:
{
product: vertx
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: CEQ 3.2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
defaultStatus: unaffected
packageName: vertx-core
cpe: cpe:/a:redhat:camel_quarkus:3
}
{
vendor: Red Hat
product: Red Hat build of Quarkus 3.2.11.Final
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: io.vertx/vertx-core
defaultStatus: affected
versions:
version: 4.4.8.redhat-00001, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:quarkus:3.2::el8
}
{
vendor: Red Hat
product: A-MQ Clients 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:a_mq_clients:2
}
{
vendor: Red Hat
product: Cryostat 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:cryostat:2
}
{
vendor: Red Hat
product: Migration Toolkit for Applications 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: affected
cpes: cpe:/a:redhat:migration_toolkit_applications:6
}
{
vendor: Red Hat
product: Migration Toolkit for Runtimes
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: affected
cpes: cpe:/a:redhat:migration_toolkit_runtimes:1
}
{
vendor: Red Hat
product: OpenShift Serverless
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:serverless:1
}
{
vendor: Red Hat
product: Red Hat build of Apache Camel 4.0 for Spring Boot
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:camel_spring_boot:4
}
{
vendor: Red Hat
product: Red Hat build of Apache Camel for Spring Boot
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:camel_spring_boot:3
}
{
vendor: Red Hat
product: Red Hat Build of Keycloak
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:build_keycloak:22
}
{
vendor: Red Hat
product: Red Hat build of OptaPlanner 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:optaplanner:::el6
}
{
vendor: Red Hat
product: Red Hat build of Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: io.vertx/vertx-core
defaultStatus: affected
cpes: cpe:/a:redhat:quarkus:2
}
{
vendor: Red Hat
product: Red Hat Data Grid 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_data_grid:8
}
{
vendor: Red Hat
product: Red Hat Integration Camel K
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:integration:1
}
{
vendor: Red Hat
product: Red Hat Integration Camel Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:camel_quarkus:2
}
{
vendor: Red Hat
product: Red Hat Integration Service Registry
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:service_registry:2
}
{
vendor: Red Hat
product: Red Hat JBoss A-MQ 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:amq_broker:7
}
{
vendor: Red Hat
product: Red Hat JBoss A-MQ Streams
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:amq_streams:1
}
{
vendor: Red Hat
product: Red Hat JBoss Data Grid 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_data_grid:7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vertx-core
defaultStatus: unaffected
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vertx-core
defaultStatus: unaffected
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:jbosseapxp
}
{
vendor: Red Hat
product: Red Hat JBoss Fuse 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: vertx-core
defaultStatus: unaffected
cpes: cpe:/a:redhat:jboss_fuse:7
}
{
vendor: Red Hat
product: Red Hat Process Automation 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: vertx-core
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]