Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support

Description

A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.

Timeline

Scores

EPSS (exploitation in 30 days)

1.1% · top 35% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

• CWE-772: Missing Release of Resource after Effective Lifetime (opens in a new tab)All about CWE-772 and its CVEs

Affected products

• io.vertx:vertx-core

  • affected 4.3.4 – ≤ 4.5.2

• Red Hat · CEQ 3.2

  All versions: unaffected

• Red Hat · Cryostat 2 on RHEL 8

  • unaffected 2.4.0-7 – < *

• Red Hat · Cryostat 2 on RHEL 8

  • unaffected 2.4.0-4 – < *

• Red Hat · Cryostat 2 on RHEL 8

  • unaffected 2.4.0-4 – < *

• Red Hat · Cryostat 2 on RHEL 8

  • unaffected 2.4.0-4 – < *

• Red Hat · Cryostat 2 on RHEL 8

  • unaffected 2.4.0-9 – < *

• Red Hat · Cryostat 2 on RHEL 8

  • unaffected 2.4.0-4 – < *

• Red Hat · Migration Toolkit for Runtimes 1 on RHEL 8

  • unaffected 1.2-18 – < *

• Red Hat · Migration Toolkit for Runtimes 1 on RHEL 8

  • unaffected 1.2-11 – < *

• Red Hat · Migration Toolkit for Runtimes 1 on RHEL 8

  • unaffected 1.2-12 – < *

• Red Hat · Migration Toolkit for Runtimes 1 on RHEL 8

  • unaffected 1.2-10 – < *

• Red Hat · MTA-6.2-RHEL-9

  • unaffected 6.2.3-2 – < *

• Red Hat · Red Hat AMQ Streams 2.7.0

  All versions: unaffected

• Red Hat · Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2

  All versions: unaffected

• Red Hat · Red Hat build of Quarkus 3.2.11.Final

  • unaffected 4.4.8.redhat-00001 – < *

• Red Hat · RHINT Service Registry 2.5.11 GA

  All versions: unaffected

• Red Hat · A-MQ Clients 2

  All versions: unaffected

• Red Hat · OpenShift Serverless

  All versions: unaffected

• Red Hat · Red Hat AMQ Broker 7

  All versions: unaffected

• Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3

  All versions: affected

• Red Hat · Red Hat build of Apache Camel for Spring Boot 3

  All versions: affected

• Red Hat · Red Hat Build of Keycloak

  All versions: affected

• Red Hat · Red Hat build of OptaPlanner 8

  All versions: affected

• Red Hat · Red Hat build of Quarkus

  All versions: affected

• Red Hat · Red Hat Data Grid 8

  All versions: unaffected

• Red Hat · Red Hat Fuse 7

  All versions: unaffected

• Red Hat · Red Hat Integration Camel K 1

  All versions: affected

• Red Hat · Red Hat Integration Camel Quarkus 2

  All versions: affected

• Red Hat · Red Hat JBoss Data Grid 7

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform 7

  All versions: unaffected

• Red Hat · Red Hat JBoss Enterprise Application Platform 8

  All versions: unaffected

• Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack

  All versions: unaffected

• Red Hat · Red Hat Process Automation 7

  All versions: affected

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenio.vertx:vertx-coreGHSA-9ph3-v2vh-3qx7 (opens in a new tab)

What to do

Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

References (11)

• RHSA-2024:1662 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:1706 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:1923 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:2088 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:2833 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:3527 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:3989 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:4884 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• https://access.redhat.com/security/cve/CVE-2024-1300 (opens in a new tab)vdb-entryx_refsource_REDHATx_transferred
• RHBZ#2263139 (opens in a new tab)issue-trackingx_refsource_REDHATx_transferred
• https://vertx.io/docs/vertx-core/java/#_server_name_indication_sni. (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-9ph3-v2vh-3qx7 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-1300](https://trackcve.app/badge/CVE-2024-1300.svg)](https://trackcve.app/cve/CVE-2024-1300)

Record last updated 5 Nov 2026, 11:43 UTC.