CVE-2024-1023: Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-27 · updated 2026-09-23
Weakness: CWE-401

Description

A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.

Affected products

Red Hat build of Keycloak 26.4: all versions
Red Hat Cryostat 2 on RHEL 8: all versions — fixed in 2.4.0-4, 2.4.0-7, 2.4.0-9
Red Hat Migration Toolkit for Runtimes: all versions
Red Hat MTA-6.2-RHEL-9: all versions — fixed in 6.2.3-2
Red Hat build of Apache Camel 4 for Quarkus 3: all versions
Red Hat build of Apache Camel for Spring Boot 3: all versions
Red Hat build of OptaPlanner 8: all versions
Red Hat build of Quarkus 3.2.11.Final: all versions — fixed in 4.4.8.redhat-00001
Red Hat Data Grid 8: all versions
Red Hat Integration Camel K 1: all versions
Red Hat Integration Camel Quarkus 2: all versions
Red Hat JBoss Data Grid 7: all versions

How to fix

Upgrade to a fixed version: Red Hat Cryostat 2 on RHEL 8 2.4.0-4, 2.4.0-7, 2.4.0-9; Red Hat MTA-6.2-RHEL-9 6.2.3-2; Red Hat build of Quarkus 3.2.11.Final 4.4.8.redhat-00001. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1023 or the next vulnerability affects your stack