Vert.x STOMP server process client frames that would not send initially a connect frame
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4.4.2, a Vert.x STOMP server processes client STOMP frames without checking that the client send an initial CONNECT frame replied with a successful CONNECTED frame. The client can subscribe to a destination or publish message without prior authentication. Any Vert.x STOMP server configured with an authentication handler is impacted. The issue is patched in Vert.x 3.9.16 and 4.4.2. There are no trivial workarounds.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vert-x3 | vertx-stomp | 3.1.0 to before 3.9.16; 4.0.0 to before 4.4.2 | 3.9.16, 4.4.2 | Patch available | CNA |
| — | io.vertx:vertx-stomp (Maven) | 3.1.0 to before 3.9.16 | 3.9.16 | Patch available | GHSA-gvrq-cg5r-7chp |
| — | io.vertx:vertx-stomp (Maven) | 4.0.0 to before 4.4.2 | 4.4.2 | Patch available | GHSA-gvrq-cg5r-7chp |
- vertx-stomp Vendorvert-x3 Affected 3.1.0 to before 3.9.16; 4.0.0 to before 4.4.2 Fixed in 3.9.16, 4.4.2 Patch available CNA
- io.vertx:vertx-stomp (Maven) Vendor— Affected 3.1.0 to before 3.9.16 Fixed in 3.9.16 Patch available GHSA-gvrq-cg5r-7chp
- io.vertx:vertx-stomp (Maven) Vendor— Affected 4.0.0 to before 4.4.2 Fixed in 4.4.2 Patch available GHSA-gvrq-cg5r-7chp
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:vert.x_stomp:*:*:*:*:*:*:*:* | 3.1.0 to before 3.9.16; 4.0.0 to before 4.4.2 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:vert.x_stomp:*:*:*:*:*:*:*:* Versions 3.1.0 to before 3.9.16; 4.0.0 to before 4.4.2 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA vertx-stomp (vert-x3) Fixed in 3.9.16, 4.4.2
- Fix · GHSA-gvrq-cg5r-7chp io.vertx:vertx-stomp (Maven) Fixed in 3.9.16 Advisory →
- Fix · GHSA-gvrq-cg5r-7chp io.vertx:vertx-stomp (Maven) Fixed in 4.4.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Application Runtimes
Timeline
- 2026-10-02 Threatist record created from CVE-2023-32081
- 2026-10-03 Alias added: GHSA-gvrq-cg5r-7chp
References
Sources
- CVE-2023-32081 · CVE Program
- CVE-2023-32081 · NVD
- FIRST EPSS
- GHSA-gvrq-cg5r-7chp · GitHub Advisory Database · CC BY 4.0
- CVE-2023-32081 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences