io.vertx:vertx-core 4.5.23

Direct Vulnerabilities

Known vulnerabilities in the io.vertx:vertx-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Allocation of Resources Without Limits or Throttling io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling during the TLS handshake process, where the `SslContext` cache can be forced to grow indefinitely. The `SSLHelper`, `SslChannelProvider`, and `SslContextProvider` classes responsible for this caching in different versions all exhibit the same vulnerable behavior. A malicious client can disrupt service by sending a large number of distinct valid SNI names. This is particularly likely when the server has a broad hostname rule such as a wildcard. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `io.vertx:vertx-core` to version 4.5.27, 5.0.12 or higher.	[4.3.4,4.5.27)[5.0.0.CR1,5.0.12)
M HTTP Request Smuggling io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM. Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper handling of `/` in the output buffer by `removeDots()` function in Static Handler. An attacker can prevent access to static files by sending specifically crafted request URIs that exploit improper handling of encoded path traversal sequences. How to fix HTTP Request Smuggling? Upgrade `io.vertx:vertx-core` to version 4.5.24 or higher.	[,4.5.24)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling during the TLS handshake process, where the SslContext cache can be forced to grow indefinitely. The SSLHelper, SslChannelProvider, and SslContextProvider classes responsible for this caching in different versions all exhibit the same vulnerable behavior. A malicious client can disrupt service by sending a large number of distinct valid SNI names. This is particularly likely when the server has a broad hostname rule such as a wildcard.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.vertx:vertx-core to version 4.5.27, 5.0.12 or higher.

[4.3.4,4.5.27)[5.0.0.CR1,5.0.12)

HTTP Request Smuggling

io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM.

Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper handling of / in the output buffer by removeDots() function in Static Handler. An attacker can prevent access to static files by sending specifically crafted request URIs that exploit improper handling of encoded path traversal sequences.

How to fix HTTP Request Smuggling?

Upgrade io.vertx:vertx-core to version 4.5.24 or higher.

[,4.5.24)

io.vertx:vertx-core@4.5.23

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically