Executive brief
Stomper is a message broker implementing the STOMP (Streaming Text Oriented Messaging Protocol) protocol. A vulnerability allows an unauthenticated attacker to trigger a use-after-free condition by sending multiple CONNECT frames on the same connection followed by SEND frames to previously subscribed destinations, causing the broker process to crash and potentially leading to denial of service or remote code execution.
Technical details
This is a heap use-after-free vulnerability in the Stomper STOMP message broker. The root cause is improper state management of StompStreamSocket objects when a client sends multiple CONNECT frames on the same TCP connection. When a subsequent client sends SEND frames to a destination that was previously subscribed on the now-freed connection, the broker dereferences a pointer to an already-freed socket object. The attack vector is network-based, requiring no authentication due to default protocol configuration. Successful exploitation results in a heap use-after-free, causing process crash (denial of service), though remote code execution may be possible depending on heap layout and exploitation technique. Patch availability is not mentioned in available sources.
Affected products
- Stomper 5e2741e (commit hash)
Timeline
- 2026-08-26: disclosed
- 2026-08-26: advisory: CVE-2026-26448 published