Executive brief
stomper is an open-source message broker implementing the STOMP protocol, used to queue and deliver messages between applications. An attacker can exploit a vulnerability to send incomplete message frames that cause sockets to hang permanently, accumulating until the broker stops responding to new requests and effectively becomes unavailable.
Technical details
The vulnerability is a denial-of-service condition in the STOMP message broker's frame handling. A malicious client sends partial STOMP frames and holds TCP connections open, exploiting the broker's use of edge-triggered epoll (EPOLLET) and MSG_PEEK in recv() calls. This causes affected sockets to enter a permanent half-read state where the broker no longer receives epoll events for those connections. When enough such connections accumulate, the broker exhausts its ability to process events and hangs in epoll_wait(), unable to handle new messages or connections. The vulnerability requires network access to the broker but no authentication.
Affected products
- mdoi stomper commit 5e2741e and likely earlier versions
Timeline
- 2026-08-26: disclosed
- 2026-08-26: advisory: CVE-2026-26445 published