Eclipse Vert.x vulnerable to a memory leak in TCP servers
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | io.vertx:vertx-core | >= 4.3.4, < 4.4.8, >= 4.5.0, < 4.5.3 | 4.4.8, 4.5.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-1300
- https://github.com/eclipse-vertx/vert.x/pull/5101
- https://github.com/eclipse-vertx/vert.x/pull/5100
- https://github.com/eclipse-vertx/vert.x/pull/5099
- https://github.com/eclipse-vertx/vert.x/commit/7ad34ea9d78f85e26b231ee3ec8d492d10046479
- https://github.com/eclipse-vertx/vert.x/commit/3d9235cadf44df39a70dc75bddfe0b8fcbd6a683
- https://vertx.io/docs/vertx-core/java/#_server_name_indication_sni.
- https://github.com/eclipse-vertx/vert.x
- https://bugzilla.redhat.com/show_bug.cgi?id=2263139
- https://access.redhat.com/security/cve/CVE-2024-1300
- https://access.redhat.com/errata/RHSA-2024:4884
- https://access.redhat.com/errata/RHSA-2024:3989
- https://access.redhat.com/errata/RHSA-2024:3527
- https://access.redhat.com/errata/RHSA-2024:2833
- https://access.redhat.com/errata/RHSA-2024:2088
- https://access.redhat.com/errata/RHSA-2024:1923
- https://access.redhat.com/errata/RHSA-2024:1706
- https://access.redhat.com/errata/RHSA-2024:1662
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L- Weakness (CWE)
CWE-400, CWE-772- Platform
- Java / Kotlin (Maven)
- Package
io.vertx:vertx-core- Disclosed
- 02.04.2024
- Updated
- 11.10.2026 12:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-9ph3-v2vh-3qx7 - CC BY 4.0
Vulnerability history: io.vertx:vertx-core
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 7
- First → latest
- 10.2018 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 7
Disclosures per year
- 2018: 3
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 2
- 2025: 0
- 2026: 2
-
Eclipse Vert.x vulnerable to a memory leak in TCP servers this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.