CVE-2024-1300: Missing Release of Resource after Effective Lifetime
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
AI Analysis
Technical Summary
This vulnerability in Eclipse Vert.x occurs due to improper handling of unknown SNI server names in TCP servers configured with TLS and SNI support. Instead of discarding or properly managing SSL contexts for unknown server names, the server erroneously caches the SSL context in the server name map. This results in a memory leak that can be exploited by attackers sending TLS client hello messages with arbitrary server names, causing the Java Virtual Machine (JVM) to run out of memory. The issue is identified in Vert.x version 4.3.4. Red Hat advisories confirm the vulnerability and provide updates in their build of Quarkus 3.2.11 to mitigate this problem.
Potential Impact
The vulnerability leads to memory exhaustion on the server side, potentially causing JVM out-of-memory errors and denial of service conditions. Confidentiality and integrity impacts are low or none, but availability is affected due to resource exhaustion. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released security updates for their build of Quarkus 3.2.11 that address this vulnerability. Users should apply these official updates to remediate the issue. Before applying updates, ensure all previous errata relevant to the system are applied and back up existing installations. Patch status is confirmed by Red Hat advisories linked in the references. No alternative mitigations are specified.
CVE-2024-1300: Missing Release of Resource after Effective Lifetime
Description
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
CVSS v3.1
Score 5.4medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Eclipse Vert.x occurs due to improper handling of unknown SNI server names in TCP servers configured with TLS and SNI support. Instead of discarding or properly managing SSL contexts for unknown server names, the server erroneously caches the SSL context in the server name map. This results in a memory leak that can be exploited by attackers sending TLS client hello messages with arbitrary server names, causing the Java Virtual Machine (JVM) to run out of memory. The issue is identified in Vert.x version 4.3.4. Red Hat advisories confirm the vulnerability and provide updates in their build of Quarkus 3.2.11 to mitigate this problem.
Potential Impact
The vulnerability leads to memory exhaustion on the server side, potentially causing JVM out-of-memory errors and denial of service conditions. Confidentiality and integrity impacts are low or none, but availability is affected due to resource exhaustion. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released security updates for their build of Quarkus 3.2.11 that address this vulnerability. Users should apply these official updates to remediate the issue. Before applying updates, ensure all previous errata relevant to the system are applied and back up existing installations. Patch status is confirmed by Red Hat advisories linked in the references. No alternative mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2024-02-07T07:11:11.156Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/errata/RHSA-2024:1662","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2024:1706","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2024:1923","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2024:2088","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2024:2833","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2024:3527","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2024:3989","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2024:4884","vendor":"Red Hat"},{"url":"https://access.redhat.com/security/cve/CVE-2024-1300","vendor":"Red Hat"}]
Threat ID: 690dcfa5c2e5047ad7418662
Added to database: 11/07/2025, 10:53:25 UTC
Last enriched: 08/05/2026, 13:32:20 UTC
Last updated: 08/23/2026, 22:52:02 UTC
Views: 344
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.