Executive brief
Stomper is an open-source message broker implementing the STOMP (Streaming Text Orientated Messaging Protocol) standard. A flaw in its subscription cleanup logic allows an unauthenticated client to crash the broker process by repeatedly subscribing to the same message queue and then disconnecting, resulting in service unavailability.
Technical details
A heap use-after-free vulnerability exists in StompClient's subscription management during connection teardown. When a client issues multiple SUBSCRIBE commands for the same destination over a single connection, the broker stores duplicate pointers to the same Binding object in the client's Bindings list without checking for duplicates. Upon client disconnection, the StompClient destructor iterates the Bindings list and calls Binding::unbind() and BindingManager::remove() on each entry. The first iteration frees the Binding object; subsequent iterations operate on the freed memory, triggering a crash. The vulnerability requires no authentication and affects any broker instance receiving a specially crafted SUBSCRIBE sequence followed by disconnection. A fix involves either deduplicating subscriptions per binding during subscribe() or modifying the destructor to handle duplicate references safely.
Affected products
- Stomper commit 5e2741e
Timeline
- 2026-08-26: disclosed
- 2026-08-26: advisory: CVE-2026-26447