CVE-2024-1300
Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
- Record
CVE-2024-1300- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-05
EUVDEUVD-2024-1174
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
- Record
EUVD-2024-1174- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-9ph3-v2vh-3qx7
Eclipse Vert.x vulnerable to a memory leak in TCP servers
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
- Record
GHSA-9ph3-v2vh-3qx7- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-400, CWE-772
- Updated
- 2026-11-02
NVD
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
- Record
CVE-2024-1300- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-05
OSVGHSA-9ph3-v2vh-3qx7
Eclipse Vert.x vulnerable to a memory leak in TCP servers
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
- Record
GHSA-9ph3-v2vh-3qx7- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-400, CWE-772
- Updated
- 2026-11-02
Affected products
- red hat a-mq clients 2
- red hat ceq 3.2
- red hat cryostat 2 on rhel 8
- red hat migration toolkit for runtimes 1 on rhel 8
- red hat mta-6.2-rhel-9
- red hat openshift serverless
- red hat amq broker 7
- red hat amq streams 2.7.0
- red hat build of apache camel 4 for quarkus 3
- red hat build of apache camel 4.4.1 for spring boot 3.2
- red hat build of apache camel for spring boot 3
- red hat build of keycloak
Show 13 moreShow less
- red hat build of optaplanner 8
- red hat build of quarkus
- red hat build of quarkus 3.2.11.final
- red hat data grid 8
- red hat fuse 7
- red hat integration camel k 1
- red hat integration camel quarkus 2
- red hat jboss data grid 7
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform expansion pack
- red hat process automation 7
- red hat rhint service registry 2.5.11 ga
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.vertx:vertx-coreMaven |
4.3.4 up to 4.4.8 | 4.4.8 |
io.vertx:vertx-coreMaven |
4.5.0 up to 4.5.3 | 4.5.3 |
io.vertx:vertx-coreMaven |
4.3.4 up to 4.4.8, plus listed versions 4.3.54.3.64.3.74.3.84.4.0 Show 7 moreShow less4.4.14.4.24.4.34.4.44.4.54.4.64.4.7 |
4.4.8 |
io.vertx:vertx-coreMaven |
4.5.0 up to 4.5.3, plus listed versions 4.5.14.5.2 |
4.5.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-1300 is a medium vulnerability (CVSS 5.4) in Red Hat A-mq Clients 2, published April 2, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in io.vertx:vertx-core 4.4.8.
References
access.redhat.com/errata/RHSA-2024:1662
Show 13 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2263139
vertx.io/docs/vertx-core/java
nvd.nist.gov/vuln/detail/CVE-2024-1300
github.com/eclipse-vertx/vert.x/pull/5099