CVE-2023-32081

Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4.4.2, a Vert.x STOMP server processes client STOMP frames without checking that the client send an initial CONNECT frame replied with a successful CONNECTED frame. The client can subscribe to a destination or publish message without prior authentication. Any Vert.x STOMP server configured with an authentication handler is impacted. The issue is patched in Vert.x 3.9.16 and 4.4.2. There are no trivial workarounds.

• CWE-287

• https://github.com/vert-x3/vertx-stomp/commit/0de4bc5a44ddb57e74d92c445f16456fa03f265bPatch
• https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-gvrq-cg5r-7chpVendor Advisory
• https://github.com/vert-x3/vertx-stomp/commit/0de4bc5a44ddb57e74d92c445f16456fa03f265bPatch
• https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-gvrq-cg5r-7chpVendor Advisory

Published

May 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32076in-toto is a framework to protect supply chain integrity. Th…5.5
• CVE-2023-32077Netmaker makes networks with WireGuard. Prior to versions 0.…7.5
• CVE-2023-32078Netmaker makes networks with WireGuard. An Insecure Direct O…7.5
• CVE-2023-32079Netmaker makes networks with WireGuard. A Mass assignment vu…8.8
• CVE-2023-3208A vulnerability, which was classified as critical, has been …8.8
• CVE-2023-32080Wings is the server control plane for Pterodactyl Panel. A v…8.8
• CVE-2023-32082etcd is a distributed key-value store for the data of a dist…4.3
• CVE-2023-32083Microsoft Failover Cluster Information Disclosure Vulnerabil…4.9
• CVE-2023-32084HTTP.sys Denial of Service Vulnerability7.5
• CVE-2023-32085Microsoft PostScript and PCL6 Class Printer Driver Informati…5.5
• CVE-2023-32086Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-32087 Pega Platform versions 8.1 to Infinity 23.1.0 are affected …6.1