EUVD-2026-66753
GHSA-m2x8-gg52-7xpc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network frame sequence (AV:N/AC:L/PR:N/UI:N); only a process crash is demonstrated, so A:H with C:N/I:N since code execution is unproven despite the UAF.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client (or a later connection) sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a StompStreamSocket object that has already been freed. This results in a heap use-after-free and process crash. Because the protocol does not authenticate or restrict such sequences by default.
AnalysisAI
Denial-of-service (and potential memory corruption) in the Stomper STOMP message broker (commit 5e2741e) lets remote attackers crash the broker process by abusing frame sequencing. By opening a connection that sends multiple CONNECT frames and subscribes a destination, then having another client SEND to that destination, an attacker triggers a heap use-after-free on a freed StompStreamSocket object. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The concrete prerequisite is network access to the broker's STOMP TCP listener and the ability to send STOMP frames - no authentication is required (CVSS PR:N; the description states the protocol does not authenticate or restrict such sequences by default). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and warrant nuance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version was identified at time of analysis (the EUVD lists no fixed version and references point to the source repository and a bug report rather than a tagged release), so treat remediation as compensating controls. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Stomper STOMP broker instances in production and non-production environments, immediately restrict network access to authorized systems only through firewall rules, and disable external connectivity where operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today