Executive brief
Stomper is a STOMP protocol message broker used for message queuing and distribution. A specially crafted message without a required destination header causes the server process to crash, resulting in a denial of service that disrupts message delivery for all clients.
Technical details
The vulnerability is a null pointer dereference in the StompSend class. The Dest member variable is not initialized in the constructor and is only set via set_header() when a destination header is present in the SEND frame. An attacker can send a SEND frame with a missing destination header; the uninitialized Dest pointer then contains garbage values, and when execute() attempts to dereference it with Dest->name(), the process crashes. Attack vector is network; the attacker must first complete a STOMP CONNECT handshake, but no additional authentication bypass is required. The fix is to initialize Dest to NULL in the constructor and add proper null checks before dereferencing.
Affected products
- mdoi Stomper commit 5e2741e
Timeline
- 2026-08-26: disclosed