EUVD-2026-66754
GHSA-3h57-jwg8-vm79
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to Stomper broker port
-
DeliverySend repeated SUBSCRIBE frames for same destination
-
ExploitClose the connection
-
ExecutionBroker executes incorrect subscription cleanup
-
PersistHeap use-after-free during StompClient destruction
-
ImpactBroker process crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration or non-default settings are required. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against any network-reachable instance of Stomper. The only functional prerequisite is the ability to open a TCP connection to the broker's STOMP port and send valid STOMP protocol SUBSCRIBE frames - this is standard STOMP client behavior that cannot be filtered at the protocol level without breaking legitimate clients. Exploitation is limited by: the niche deployment footprint of Stomper itself (an obscure project with no formal releases), the impact being availability-only (crash, not code execution), and the requirement that the attacker can reach the broker's network port (mitigated by firewalling). |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 and confirms the attack is trivially reachable: no authentication, no user interaction, low complexity. SSVC corroborates automatability, meaning scripted mass exploitation is feasible. However, the EPSS score of 0.15% (5th percentile) signals that actual exploitation activity is negligible at time of analysis, consistent with Stomper being an obscure, likely low-deployment broker. The vulnerability is not in CISA KEV, so in-the-wild exploitation is not confirmed. Impact is strictly availability - no confidentiality or integrity risk. The practical threat is highest for deployments that expose the Stomper broker port to untrusted or public networks; internal-only deployments face meaningful but reduced risk. The combination of easy exploitation and public POC warrants patching urgency, but the narrow product footprint limits aggregate risk. |
| Exploit ScenarioDerived | An attacker opens a TCP connection to an exposed Stomper broker and sends a rapid sequence of SUBSCRIBE frames all targeting the same destination string, then closes the connection. The broker's cleanup path dereferences a freed heap object during StompClient destruction, crashing the process. A public proof-of-concept bug report documents this exact sequence, and the attack is automatable and repeatable - the broker can be crashed as fast as new connections can be opened. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Heap use-after-free in Stomper (commit 5e2741e) allows any unauthenticated network client to reliably crash the broker process by repeatedly issuing SUBSCRIBE commands for the same destination on a single connection and then closing it. The broker's subscription cleanup logic leaves dangling pointers in internal structures that are dereferenced during StompClient destruction, causing a denial of service. A proof-of-concept bug report is publicly available; SSVC classifies exploitation as automatable, though EPSS sits at only 0.15% (5th percentile), consistent with a niche product not yet widely targeted.
RemediationAI
No vendor-released patched version has been identified at time of analysis. Operators should monitor the Stomper GitHub repository at https://github.com/mdoi/stomper for a fix commit addressing the subscription cleanup logic. As compensating controls: restrict broker network exposure using firewall rules so only trusted client IP ranges can reach the STOMP listener port - this eliminates unauthenticated remote exploitation while the patch is pending (trade-off: breaks intended open-access broker use cases). Implement connection-level rate limiting or SUBSCRIBE command throttling to slow automated exploitation attempts, though this does not eliminate the flaw. Monitor broker logs for clients issuing repeated SUBSCRIBE commands to the same destination before disconnecting, which is the precise trigger pattern. Consider replacing or disabling the Stomper broker if availability requirements cannot tolerate crash risk from public-facing exposure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Stomper implements a STOMP (Simple Text Oriented Messaging Protocol) broker that maintains internal subscription registries mapping clients to destination topics. CWE-416 (Use-After-Free) arises here because the broker fails to correctly dedupliciate or safely tear down subscription structures when a client subscribes to the same destination multiple times before disconnecting. The repeated SUBSCRIBE calls cause the same destination entry to be registered more than once; on connection close, partial or incorrect cleanup leaves stale heap references that are subsequently accessed during StompClient destruction, corrupting the heap and crashing the process. No CPE string is available in the supplied data, and the affected version is identified only by git commit hash 5e2741e from https://github.com/mdoi/stomper rather than a formal release tag.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable broker, no auth or interaction needed, crash is the sole impact - no confidentiality or integrity effect, scope unchanged.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and then closes that connection, the broker performs incorrect cleanup of its internal subscription structures. This results in a heap use-after-free during StompClient destruction, causing the broker process to crash. An unauthenticated client can exploit this to reliably trigger a denial of service.
Executive ViewAI
Stomper message broker contains a memory safety vulnerability (CVE-2026-26447) allowing unauthenticated network clients to remotely crash broker processes with publicly available exploit code. With no vendor-released patch identified at time of analysis, organizations must immediately implement interim controls to prevent broker downtime and disruption to message queue-dependent applications.
Network segmentation limiting broker access to authorized clients; per-client rate limiting and connection throttling on SUBSCRIBE commands; connection timeouts and maximum concurrent connections per client; continuous monitoring of broker stability and alerting on unexpected restarts; traffic filtering to block patterns consistent with exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB