REDHAT-BUG-2260840: Medium severity maven/io.vertx/vertx-core vulnerability
There is a regression in Vert.x 4.4 branch that leads to a memory leak due to the use of Netty FastThreadLocal data structures.
As a consequence, when the Vert.x HTTP client connects to a different host, it does make the leak progress furthermore, there might be other cases leading to the same effect but exhibiting one seems enough to demonstrate the feasability.
Thus, this can be exploited with intimate knowledge of the runtime to accelerate the memory leak, e.g. a server accepting arbitrary internet addresses for which it will connect to could be fed with addresses as an attack vector.
This affects the maven artifact io.vertx:vertx-core versions 4.4.5, 4.4.6, 4.5.0, 4.5.1
https://github.com/eclipse-vertx/vert.x/issues/5078 https://github.com/eclipse-vertx/vert.x/pull/5082 https://github.com/eclipse-vertx/vert.x/pull/5080
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If your application accepts arbitrary internet addresses for the Vert.x HTTP client to connect to, restrict/validate the destination hosts so attackers cannot supply arbitrary addresses that would accelerate the memory leak.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2260840?
The severity of REDHAT-BUG-2260840 is high due to the potential for a memory leak in the Vert.x HTTP client.
How do I fix REDHAT-BUG-2260840?
To resolve REDHAT-BUG-2260840, upgrade Vert.x to version 4.5.1 or higher.
What software is affected by REDHAT-BUG-2260840?
Eclipse Vert.x versions between 4.4.5 and 4.5.1 are affected by REDHAT-BUG-2260840.
What causes REDHAT-BUG-2260840?
REDHAT-BUG-2260840 is caused by a regression in the Vert.x 4.4 branch related to Netty FastThreadLocal data structures.
Is there a known mitigation for REDHAT-BUG-2260840?
Currently, the only effective mitigation for REDHAT-BUG-2260840 is to upgrade to a later version of Vert.x.