Vulnerability record/PUBLISHED/Published Apr 2, 2024 07:33:05 UTC

CVE-2024-1300

A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.

Base score5.4/ 10

SeverityMediumCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredLowPR

User interactionNoneUI

ScopeUnchangedS

Confidentiality impactLowC

Integrity impactNoneI

Availability impactLowA

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authorityredhat

Last updatedNov 5, 2026 11:43:47 UTC

PublishedApr 2, 2024 07:33:05 UTC

ReservedFeb 7, 2024 07:11:11 UTC