CVE-2026-26446: Stomper SIGPIPE Denial of Service Vulnerability

CVE-2026-26446 is a denial of service vulnerability in Stomper 5e2741e caused by SIGPIPE when sending data to closed TCP connections. Unauthenticated attackers can crash the server by closing sockets at specific points. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-26446 Overview

CVE-2026-26446 affects Stomper commit 5e2741e, a STOMP protocol broker implementation. The broker crashes when it attempts to send data to a client whose TCP connection has been closed by the peer. The write triggers a SIGPIPE signal that the process does not handle, causing immediate termination. Any unauthenticated client can trigger the crash by closing its socket at specific points in the message flow, producing a denial-of-service condition against the broker.

Critical Impact
An unauthenticated remote attacker can terminate the Stomper broker process by closing a TCP socket at a specific point, disrupting message delivery for all connected clients.

Affected Products

Stomper broker at commit 5e2741e (STOMP protocol implementation hosted at mdoi/stomper)

Discovery Timeline

2026-08-26 - CVE-2026-26446 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-26446

Vulnerability Analysis

Stomper is a broker for the Streaming Text Oriented Messaging Protocol (STOMP). Brokers accept client TCP connections and deliver frames such as MESSAGE, CONNECTED, and RECEIPT back to subscribers. The defect covered by CVE-2026-26446 is a missing signal handler for SIGPIPE in the server process.

When the broker writes to a socket whose remote peer has already sent FIN or RST, the operating system delivers SIGPIPE to the writing process. The default disposition of SIGPIPE is to terminate the process. Because Stomper does not ignore this signal or use the MSG_NOSIGNAL flag on send(), a single failed write to a closed socket takes the broker down for every connected client. This is a denial-of-service defect in the class of unhandled signal errors.

Root Cause

The root cause is missing signal handling around socket write operations. A hardened server either installs signal(SIGPIPE, SIG_IGN) at startup, blocks the signal with sigprocmask, or passes MSG_NOSIGNAL to each send() call and inspects the returned EPIPE. Stomper does none of these, so a routine write() on a half-closed connection propagates as a fatal signal instead of an EPIPE errno that the code could handle.

Attack Vector

Exploitation requires only network reachability to the broker's listening port and no authentication. An attacker opens a TCP session, sends STOMP frames that cause the broker to queue an outbound message, then closes the socket before the broker completes the write. The next send() triggers SIGPIPE and the process exits. The reported behavior is documented in the Stomper vulnerability report. No code example is reproduced here; refer to the linked report for reproduction steps.

Detection Methods for CVE-2026-26446

Indicators of Compromise

Unexpected termination of the Stomper broker process without a stack trace or graceful shutdown log entry.
Process exit status consistent with signal 13 (SIGPIPE) in the parent supervisor or dmesg output.
Repeated short-lived TCP connections from a single source that terminate immediately after the broker sends its first frame.
Gaps in STOMP MESSAGE delivery to subscribers coinciding with broker restarts.

Detection Strategies

Monitor the broker process for restart loops using systemd, supervisord, or container orchestrator health checks.
Correlate broker crash timestamps with connection logs to identify clients that closed the socket immediately before termination.
Inspect packet captures on the STOMP port for TCP FIN or RST packets sent by clients before receiving the server's CONNECTED or MESSAGE frame.

Monitoring Recommendations

Alert on any process exit with signal 13 for the Stomper binary in host telemetry.
Track connection duration histograms on the STOMP listener and alert on spikes in sub-second connections from a single peer.
Ingest broker and reverse-proxy access logs into a centralized platform to correlate abnormal connection patterns with service outages.

How to Mitigate CVE-2026-26446

Immediate Actions Required

Restrict network exposure of the Stomper listener to trusted client subnets using firewall rules or a private overlay network.
Run the broker under a process supervisor that restarts it on crash, reducing outage duration until a code fix is deployed.
Place a reverse proxy or TCP load balancer in front of the broker to terminate abusive client connections.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-26446 at the time of publication. Consult the upstream repository at mdoi/stomper for updated commits that install a SIGPIPE handler or use MSG_NOSIGNAL on writes. Rebuild and redeploy from a commit that includes the fix once available.

Workarounds

Wrap broker startup so the parent shell runs trap '' PIPE and executes the binary, causing the child to inherit SIGPIPE as ignored.
Use a LD_PRELOAD shim that calls signal(SIGPIPE, SIG_IGN) before main() for environments where source changes are not possible.
Terminate STOMP traffic at a proxy that absorbs peer resets before they reach the broker socket.

bash

# Ignore SIGPIPE for the broker process without modifying source
trap '' PIPE
exec ./stomper