Eclipse Vert.x caching client and parser flaws leak responses and exhaust memory
Vert.x, a Java toolkit, can be stalled or leak others' replies.
Summary
When one Vert.x caching web client is shared across users, one user's response can be served to others. The Redis client and STOMP parser also keep buffering data that never ends a line, which can exhaust memory and stop the service. Versions 4.0.0 to 4.5.35 and 5.0.0 to 5.2.2 are affected.
Affected when
- CachingWebClient shared across users
- Vert.x STOMP used as a server or client
What to do
The Redis client advisory says to update to 5.2.3 on the 5.x line and 4.5.36 on the 4.5.x line. The sources do not give fixed versions for the caching client or STOMP, so check the vendor advisory.
Update to at least the version for your product:
- Eclipse Vert.x 5.x 5.2.3 or later
- Eclipse Vert.x 4.5.x 4.5.36 or later
Products and platforms
CVE IDs
Sources
Times
First published
First seen