Eclipse Vert.x vulnerabilities

In Eclipse Vert.x up to versions 4.5.29 (4.x) and 5.1.4 (5.x), the DefaultRedirectHandler (vertx-core) forwards all request headers, including credential headers (Authorization, Cookie, Proxy-Authorization) and custom headers (e.g., X-API-Token), during cross-origin HTTP 30x redirects. No origin comparison (scheme, host, port) is performed before copying headers to the redirect target.

A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. Attackers can send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.

A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. The leak occurs when the Vert.x HTTP client establishes connections to different hosts, and can be accelerated by an attacker with intimate runtime knowledge. A server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.