CVE-2026-26448 in Stomper
Summary
by MITRE • 08/26/2026
Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client (or a later connection) sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a StompStreamSocket object that has already been freed. This results in a heap use-after-free and process crash. Because the protocol does not authenticate or restrict such sequences by default.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as CVE-5e2741e within the Stomper messaging broker represents a critical memory safety flaw classified under CWE-416, Use After Free. This defect arises from improper management of object lifecycles in response to specific sequences of STOMP protocol frames. The core technical issue occurs when a client initiates multiple CONNECT frames over a single TCP connection and subsequently sends SEND frames targeting destinations that were previously subscribed on that same connection. In this scenario, the broker fails to correctly maintain references to the StompStreamSocket objects associated with these connections. When subsequent clients or later connections attempt to interact with those specific destination queues, the internal logic attempts to dereference a pointer to a StompStreamSocket object that has already been deallocated by the system's memory manager. This results in an invalid memory access operation, leading directly to heap corruption and ultimately causing the broker process to crash due to segmentation faults or similar fatal exceptions triggered by accessing freed memory regions.
From an operational perspective, this vulnerability poses a significant risk to service availability and potentially data integrity if exploitation leads to further code execution through sophisticated heap spraying techniques. The immediate impact is a denial of service condition where the message broker becomes unresponsive following the trigger sequence. Because STOMP is often used in enterprise environments for asynchronous messaging between distributed systems, an attacker can exploit this flaw by crafting malicious frame sequences that mimic legitimate traffic patterns but include the specific timing and connection reuse characteristics required to trigger the race condition or logic error leading to the use-after-free state. The lack of default authentication means that any network-accessible client can attempt this sequence without needing valid credentials, significantly lowering the barrier for exploitation. This aligns with ATT&CK technique T1498, Network Denial of Service, as well as potential lateral movement vectors if the crash leads to unstable states in dependent services relying on the broker's availability.
Mitigation strategies must address both immediate remediation and long-term architectural resilience. The primary solution is to apply vendor-provided patches that correct the memory management logic for StompStreamSocket objects, ensuring proper reference counting or smart pointer usage to prevent premature deallocation while active subscriptions exist. In environments where patching is not immediately feasible, network-level controls such as firewalls should be configured to restrict access to the STOMP port exclusively to trusted IP addresses and application instances. Implementing strict rate limiting on CONNECT frames per source IP can also help mitigate the ability of an attacker to rapidly cycle through connections required to trigger the flaw. Furthermore, enabling authentication mechanisms for all client connections adds a layer of defense in depth by ensuring that only authorized entities can interact with the broker's subscription management features. Regular security audits focusing on memory safety and protocol state machine validation are recommended to identify similar logic errors before they reach production environments.