LiveActive security incident?Get immediate response
CVE Record

CVE-2024-1023: Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx

A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Affected Vert.x applications can steadily retain memory when their HTTP client connects to different hosts. If an attacker can influence those destinations, they may accelerate resource exhaustion and disrupt service. The issue affects availability, not data confidentiality or integrity, based on the supplied CVSS assessment.

Executive priority

Treat this as a prompt availability-hardening issue for internet-facing or multi-tenant services that permit destination control. Prioritize exposed services and affected Red Hat deployments, then schedule remaining affected applications through normal patching. Escalate if memory alarms, unexplained restarts, or attacker-influenced outbound connections are present.

Technical view

CVE-2024-1023 is a CWE-401 memory leak involving Netty FastThreadLocal data structures in Eclipse Vert.x. The supplied record identifies vertx-core 4.4.5, 4.4.6, 4.5.0, and 4.5.1 as affected. Network exploitation requires low privileges and no user interaction, with high potential availability impact.

Likely exposure

Highest exposure exists in services using an affected Vert.x version that let authenticated or otherwise privileged users influence outbound HTTP destinations. Applications connecting only to a small, controlled host set are less exposed, although normal operations may still trigger memory growth. Several Red Hat products are explicitly marked affected in the supplied record.

Exploitation context

The leak can reportedly be accelerated by someone with detailed runtime knowledge, particularly when a server accepts arbitrary internet addresses and connects to them. The supplied sources do not establish active exploitation, and the CVE is not listed as KEV in the bundle. No exploit code or observed attack campaign is identified.

Researcher notes

Exposure depends on application data flow, not merely library presence. Investigate whether untrusted input reaches Vert.x HTTP client destination selection and whether repeated connections to diverse hosts correlate with retained memory. The bundle names upstream pull requests but does not supply enough detail to assert exact patch mechanics or a universal fixed release.

Mitigation direction

  • Inventory direct and transitive vertx-core dependencies for versions 4.4.5, 4.4.6, 4.5.0, and 4.5.1.
  • Apply applicable Red Hat errata or Eclipse Vert.x guidance; the bundle does not identify one universal fixed version.
  • Restrict user-controlled outbound destinations to approved hosts where operationally possible.
  • Monitor memory growth, garbage-collection pressure, process termination, and service restarts.
  • Use resource limits and controlled restarts as temporary resilience measures, not as a permanent fix.

Validation and detection

  • Confirm deployed dependency versions from build artifacts, containers, and software inventories.
  • Identify APIs or jobs that accept URLs, hostnames, webhooks, proxies, or other outbound destinations.
  • Test representative multi-host HTTP activity in staging and compare retained memory over time.
  • Verify destination allowlists cannot be bypassed through redirects or alternate input paths.
  • After updating, confirm memory stabilizes and review vendor advisories for product-specific requirements.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-401: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-1023 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
2ADP providers
13Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H2.83.6redhat

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2024-1023Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineredhat

    Made public.

  2. Source timelineredhat

    Reported to Red Hat.

  3. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Unknown vendorvertx-corevertx-core, 4.4.5, 4.4.6, 4.5.0, 4.5.1unaffected
Red HatCEQ 3.2vert.xunaffected
Red HatCryostat 2 on RHEL 8cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, 2.4.0-7affected
Red HatCryostat 2 on RHEL 8cryostat-tech-preview/cryostat-operator-bundle, 2.4.0-4affected
Red HatCryostat 2 on RHEL 8cryostat-tech-preview/cryostat-reports-rhel8, 2.4.0-4affected
Red HatCryostat 2 on RHEL 8cryostat-tech-preview/cryostat-rhel8, 2.4.0-4affected
Red HatCryostat 2 on RHEL 8cryostat-tech-preview/cryostat-rhel8-operator, 2.4.0-9affected
Red HatCryostat 2 on RHEL 8cryostat-tech-preview/jfr-datasource-rhel8, 2.4.0-4affected
Red HatMTA-6.2-RHEL-9mta/mta-windup-addon-rhel9, 6.2.3-2affected
Red HatRed Hat AMQ Streams 2.7.0vert.xunaffected
Red HatRed Hat build of Apache Camel 4.4.1 for Spring Boot 3.2vert.xunaffected
Red HatRed Hat build of Quarkus 3.2.11.Finalio.vertx/vertx-core, 4.4.8.redhat-00001affected
Red HatRHINT Service Registry 2.5.11 GAvert.xunaffected
Red HatA-MQ Clients 2vert.xunaffected
Red HatMigration Toolkit for Runtimesvert.xaffected
Red HatOpenShift Serverlessvert.xunaffected
Red HatRed Hat AMQ Broker 7vert.xunaffected
Red HatRed Hat build of Apache Camel for Spring Boot 3vert.xaffected
Red HatRed Hat Build of Keycloakvert.xaffected
Red HatRed Hat build of OptaPlanner 8vert.xaffected
Red HatRed Hat build of Quarkusvertx-coreunaffected
Red HatRed Hat Data Grid 8vert.xaffected
Red HatRed Hat Fuse 7vert.xunaffected
Red HatRed Hat Integration Camel K 1vert.xaffected
Red HatRed Hat Integration Camel Quarkus 2vert.xaffected
Red HatRed Hat JBoss Data Grid 7vert.xaffected
Red HatRed Hat JBoss Enterprise Application Platform 7vert.xunaffected
Red HatRed Hat JBoss Enterprise Application Platform 8vert.xunaffected
Red HatRed Hat JBoss Enterprise Application Platform Expansion Packvert.xunaffected
Red HatRed Hat Process Automation 7vert.xunaffected
Weakness

CWE details

CWE-401

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-401 · source CWE mapping

Missing Release of Memory after Effective Lifetime

Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs