Is CVE-2026-26445 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26445 being exploited in the wild.

How severe is CVE-2026-26445?

High severity, with a CVSS score of 7.5, published 26 August 2026.

Which products and versions are affected?

Mdoi Stomper commit 5e2741e and likely earlier versions.

Is there a fix for CVE-2026-26445?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-26445 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-26445?

Check whether you run Mdoi Stomper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26445: stomper STOMP message broker denial of service via partial frames

CVE-2026-26445 · Severity: high · CVSS 7.5 · Published 2026-08-26

stomper is an open-source message broker implementing the STOMP protocol, used to queue and deliver messages between applications. An attacker can exploit a vulnerability to send incomplete message frames that cause sockets to hang permanently, accumulating until the broker stops responding to new requests and effectively becomes unavailable.

Technologies: Mdoi Stomper. Vendors: Mdoi.

Quick answers

Is CVE-2026-26445 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26445 being exploited in the wild.
How severe is CVE-2026-26445?: High severity, with a CVSS score of 7.5, published 26 August 2026.
Which products and versions are affected?: Mdoi Stomper commit 5e2741e and likely earlier versions.
Is there a fix for CVE-2026-26445?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-26445 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-26445?: Check whether you run Mdoi Stomper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a denial-of-service condition in the STOMP message broker's frame handling. A malicious client sends partial STOMP frames and holds TCP connections open, exploiting the broker's use of edge-triggered epoll (EPOLLET) and MSG_PEEK in recv() calls. This causes affected sockets to enter a permanent half-read state where the broker no longer receives epoll events for those connections. When enough such connections accumulate, the broker exhausts its ability to process events and hangs in epoll_wait(), unable to handle new messages or connections. The vulnerability requires network access to the broker but no authentication.

Affected products

mdoi stomper commit 5e2741e and likely earlier versions

Timeline

2026-08-26: disclosed
2026-08-26: advisory: CVE-2026-26445 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.