EUVD-2026-66753
GHSA-m2x8-gg52-7xpc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed STOMP listener
-
DeliverySend multiple CONNECT frames, subscribe destination
-
ExploitSecond client SENDs to that destination
-
ExecutionBroker dereferences freed StompStreamSocket
-
ImpactHeap use-after-free, process crash (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The concrete prerequisite is network access to the broker's STOMP TCP listener and the ability to send STOMP frames - no authentication is required (CVSS PR:N; the description states the protocol does not authenticate or restrict such sequences by default). The specific trigger sequence is: one connection sends multiple CONNECT frames and holds a subscription to a destination, then a second client or later connection sends a SEND frame to that same previously subscribed destination. Limiting factors: the target instance must be network-reachable (mitigated if bound to localhost or firewalled), the specific frame ordering must be met, and the confirmed outcome is a process crash (DoS) rather than proven code execution. |
| Impact | The signals are mixed and warrant nuance. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) treats this as full remote compromise, but the description only demonstrates a heap use-after-free leading to a process crash - i.e., a denial of service - with the tags (Denial Of Service, Memory Corruption, Use After Free) reinforcing DoS as the confirmed impact; arbitrary code execution is theoretically possible with UAF but is not evidenced here, so the C:H/I:H rating appears optimistic and should be verified. EPSS is low (0.15%, 5th percentile) and there is no CISA KEV listing, indicating no observed widespread exploitation, though SSVC rates it Automatable=yes with Technical Impact=total and Exploitation=poc. Prevalence is the dominant mitigating factor: Stomper is an obscure, small-footprint project, so any operator running an internet-exposed instance should treat a crash-on-demand DoS as urgent even though the aggregate real-world exposure is small. Bottom line: real but narrow - a genuine unauthenticated remote DoS against a niche product, not a mass-exploitation event. |
| Exploit ScenarioDerived | An attacker with network reach to an exposed Stomper broker opens a TCP connection, sends multiple CONNECT frames, and subscribes a destination, then (from another client or connection) sends a SEND frame to that destination; the broker dereferences the freed StompStreamSocket and crashes, taking down messaging for all users. A public proof-of-concept write-up documenting the frame sequence exists, and the low attack complexity plus lack of default authentication make the crash reliably reproducible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Denial-of-service (and potential memory corruption) in the Stomper STOMP message broker (commit 5e2741e) lets remote attackers crash the broker process by abusing frame sequencing. By opening a connection that sends multiple CONNECT frames and subscribes a destination, then having another client SEND to that destination, an attacker triggers a heap use-after-free on a freed StompStreamSocket object. A public proof-of-concept write-up exists (no confirmed active exploitation), and because the protocol path requires no authentication by default, exploitation is straightforward against exposed instances.
RemediationAI
No vendor-released patch or fixed version was identified at time of analysis (the EUVD lists no fixed version and references point to the source repository and a bug report rather than a tagged release), so treat remediation as compensating controls. Restrict network access to the STOMP TCP listener so it is not exposed to untrusted networks - bind it to localhost or place it behind a firewall/ACL allowing only trusted message-producing clients - since the attack requires the ability to open a connection and send CONNECT/SEND frames. Because the protocol does not authenticate these sequences by default, front the broker with an authenticating proxy or enable any available STOMP authentication to prevent arbitrary clients from establishing sessions; the trade-off is added latency and configuration overhead, and legitimate anonymous publishers/subscribers would break. Monitor the broker process for crashes and enable automatic restart (supervisor/systemd) as a stopgap to limit DoS duration. Track the upstream repository (https://github.com/mdoi/stomper) for a fix and review the bug report at https://github.com/songxpu/bug_report/blob/master/Stomp/stomper_vuln4.md.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Stomper is an implementation of a STOMP (Simple/Streaming Text Oriented Messaging Protocol) broker, a lightweight text-based publish/subscribe messaging protocol that operates over TCP. The flaw is a CWE-416 Use-After-Free: the broker tracks per-connection state in a StompStreamSocket object, and its lifecycle management fails to account for a connection sending multiple CONNECT frames while a destination remains subscribed. When a later SEND frame targets that previously subscribed destination, the broker dereferences a pointer to a StompStreamSocket that has already been freed, corrupting the heap. No CPE strings were supplied in the intelligence, so exact affected-product identification relies on the source repository (github.com/mdoi/stomper) rather than NVD CPE data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network frame sequence (AV:N/AC:L/PR:N/UI:N); only a process crash is demonstrated, so A:H with C:N/I:N since code execution is unproven despite the UAF.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client (or a later connection) sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a StompStreamSocket object that has already been freed. This results in a heap use-after-free and process crash. Because the protocol does not authenticate or restrict such sequences by default.
Executive ViewAI
Stomper STOMP message broker contains a critical vulnerability enabling unauthenticated remote denial-of-service and potential memory corruption; publicly available exploit code exists. Any exposed deployment is immediately vulnerable, directly impacting system availability and operational continuity for applications dependent on message queuing.
Implement network segmentation to restrict STOMP broker access to trusted internal networks only; deploy authentication proxies or API gateways in front of exposed instances; enable detailed logging and alerting on connection attempts and abnormal frame sequencing patterns; maintain redundant broker instances with automatic failover to mitigate denial-of-service impact on critical workflows.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB