# CVE-2026-26448: Stomper use-after-free in STOMP message broker

Source: https://junglewise.ai/threats/cve-2026-26448-stomper-use-after-free-in-stomp-message-broker  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-26448 · Severity: critical · CVSS 9.8 · Published 2026-08-26

Stomper is a message broker implementing the STOMP (Streaming Text Oriented Messaging Protocol) protocol. A vulnerability allows an unauthenticated attacker to trigger a use-after-free condition by sending multiple CONNECT frames on the same connection followed by SEND frames to previously subscribed destinations, causing the broker process to crash and potentially leading to denial of service or remote code execution.

## Quick answers

**Is CVE-2026-26448 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26448 being exploited in the wild.

**How severe is CVE-2026-26448?** Critical severity, with a CVSS score of 9.8, published 26 August 2026.

**Which products and versions are affected?** Stomper 5e2741e (commit hash).

**Is there a fix for CVE-2026-26448?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-26448 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-26448?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a heap use-after-free vulnerability in the Stomper STOMP message broker. The root cause is improper state management of StompStreamSocket objects when a client sends multiple CONNECT frames on the same TCP connection. When a subsequent client sends SEND frames to a destination that was previously subscribed on the now-freed connection, the broker dereferences a pointer to an already-freed socket object. The attack vector is network-based, requiring no authentication due to default protocol configuration. Successful exploitation results in a heap use-after-free, causing process crash (denial of service), though remote code execution may be possible depending on heap layout and exploitation technique. Patch availability is not mentioned in available sources.

## Affected products

- Stomper 5e2741e (commit hash)

## Timeline

- 2026-08-26: disclosed
- 2026-08-26: advisory: CVE-2026-26448 published

## References

- [https://github.com/mdoi/stomper](https://github.com/mdoi/stomper)
- [https://github.com/songxpu/bug_report/blob/master/Stomp/stomper_vuln4.md](https://github.com/songxpu/bug_report/blob/master/Stomp/stomper_vuln4.md)