# CVE-2026-26447: Stomper STOMP broker use-after-free in subscription cleanup

Source: https://junglewise.ai/threats/cve-2026-26447-stomper-stomp-broker-use-after-free-in-subscription-cleanup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-26447 · Severity: high · CVSS 7.5 · Published 2026-08-26

Stomper is an open-source message broker implementing the STOMP (Streaming Text Orientated Messaging Protocol) standard. A flaw in its subscription cleanup logic allows an unauthenticated client to crash the broker process by repeatedly subscribing to the same message queue and then disconnecting, resulting in service unavailability.

## Quick answers

**Is CVE-2026-26447 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26447 being exploited in the wild.

**How severe is CVE-2026-26447?** High severity, with a CVSS score of 7.5, published 26 August 2026.

**Which products and versions are affected?** Stomper commit 5e2741e.

**Is there a fix for CVE-2026-26447?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-26447 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-26447?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap use-after-free vulnerability exists in StompClient's subscription management during connection teardown. When a client issues multiple SUBSCRIBE commands for the same destination over a single connection, the broker stores duplicate pointers to the same Binding object in the client's Bindings list without checking for duplicates. Upon client disconnection, the StompClient destructor iterates the Bindings list and calls Binding::unbind() and BindingManager::remove() on each entry. The first iteration frees the Binding object; subsequent iterations operate on the freed memory, triggering a crash. The vulnerability requires no authentication and affects any broker instance receiving a specially crafted SUBSCRIBE sequence followed by disconnection. A fix involves either deduplicating subscriptions per binding during subscribe() or modifying the destructor to handle duplicate references safely.

## Affected products

- Stomper commit 5e2741e

## Timeline

- 2026-08-26: disclosed
- 2026-08-26: advisory: CVE-2026-26447

## References

- [https://github.com/mdoi/stomper](https://github.com/mdoi/stomper)
- [https://github.com/songxpu/bug_report/blob/master/Stomp/stomper_vuln3.md](https://github.com/songxpu/bug_report/blob/master/Stomp/stomper_vuln3.md)