CVE-2024-1300: Missing Release of Resource after Effective Lifetime in Red Hat CEQ 3.2

This vulnerability in Eclipse Vert.x occurs due to improper handling of unknown SNI server names in TCP servers configured with TLS and SNI support. Instead of discarding or properly managing SSL contexts for unknown server names, the server erroneously caches the SSL context in the server name map. This results in a memory leak that can be exploited by attackers sending TLS client hello messages with arbitrary server names, causing the Java Virtual Machine (JVM) to run out of memory. The issue is identified in Vert.x version 4.3.4. Red Hat advisories confirm the vulnerability and provide updates in their build of Quarkus 3.2.11 to mitigate this problem.

The vulnerability leads to memory exhaustion on the server side, potentially causing JVM out-of-memory errors and denial of service conditions. Confidentiality and integrity impacts are low or none, but availability is affected due to resource exhaustion. There are no known exploits in the wild at this time.

Red Hat has released security updates for their build of Quarkus 3.2.11 that address this vulnerability. Users should apply these official updates to remediate the issue. Before applying updates, ensure all previous errata relevant to the system are applied and back up existing installations. Patch status is confirmed by Red Hat advisories linked in the references. No alternative mitigations are specified.