CVE-2024-1023
Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
6.5
Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
- Record
CVE-2024-1023- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-05
EUVDEUVD-2024-0823
6.5
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
- Record
EUVD-2024-0823- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-5667-3wch-7q7w
6.5
Eclipse Vert.x memory leak
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
- Record
GHSA-5667-3wch-7q7w- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-119, CWE-200
- Updated
- 2026-11-02
NVD
6.5
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
- Record
CVE-2024-1023- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-05
OSV
6.5
Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
- Record
CVE-2024-1023- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-07
OSVGHSA-5667-3wch-7q7w
6.5
Eclipse Vert.x memory leak
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
- Record
GHSA-5667-3wch-7q7w- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-119, CWE-200
- Updated
- 2026-11-02
Affected products
- red hat a-mq clients 2
- red hat ceq 3.2
- red hat cryostat 2 on rhel 8
- red hat migration toolkit for runtimes
- red hat mta-6.2-rhel-9
- red hat openshift serverless
- red hat amq broker 7
- red hat amq streams 2.7.0
- red hat build of apache camel 4 for quarkus 3
- red hat build of apache camel 4.4.1 for spring boot 3.2
- red hat build of apache camel for spring boot 3
- red hat build of keycloak
Show 13 moreShow less
- red hat build of optaplanner 8
- red hat build of quarkus
- red hat build of quarkus 3.2.11.final
- red hat data grid 8
- red hat fuse 7
- red hat integration camel k 1
- red hat integration camel quarkus 2
- red hat jboss data grid 7
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform expansion pack
- red hat process automation 7
- red hat rhint service registry 2.5.11 ga
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.vertx:vertx-coreMaven |
4.5.0 up to 4.5.2 | 4.5.2 |
io.vertx:vertx-coreMaven |
4.4.5 up to 4.4.7 | 4.4.7 |
io.vertx:vertx-coreMaven |
4.5.0 up to 4.5.2, plus listed versions 4.5.1 |
4.5.2 |
io.vertx:vertx-coreMaven |
4.4.5 up to 4.4.7, plus listed versions 4.4.6 |
4.4.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-1023 is a medium vulnerability (CVSS 6.5) in Red Hat A-mq Clients 2, published March 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.65%, the 76th percentile. Fixed in io.vertx:vertx-core 4.5.2.
References
access.redhat.com/errata/RHSA-2024:1662
access.redhat.com/errata/RHSA-2024:1706
access.redhat.com/errata/RHSA-2024:2088
access.redhat.com/errata/RHSA-2024:2833
access.redhat.com/errata/RHSA-2024:3527
access.redhat.com/errata/RHSA-2024:3989
Show 16 moreShow less
access.redhat.com/errata/RHSA-2024:4884
access.redhat.com/security/cve/CVE-2024-1023
bugzilla.redhat.com/show_bug.cgi?id=2260840
github.com/eclipse-vertx/vert.x/issues/5078
github.com/eclipse-vertx/vert.x/pull/5080
github.com/eclipse-vertx/vert.x/pull/5082
nvd.nist.gov/vuln/detail/CVE-2024-1023
github.com/eclipse-vertx/vert.x/commit/665ceba38444e3929bb7b9a2a0bae2cb603fe81b
github.com/eclipse-vertx/vert.x/commit/dd6f64302b56cd4d3dcf61efaaf174b5f6ce676d
github.com/advisories/GHSA-5667-3wch-7q7w
access.redhat.com/downloads/content/package-browser
access.redhat.com/jbossnetwork/restricted/listSoftware.html
catalog.redhat.com/software/containers
mvnrepository.com/artifact/io.vertx
github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1023.json
github.com/eclipse-vertx/vert.x