CVE-2026-26447: Stomper Use-After-Free Vulnerability

CVE-2026-26447 Overview

CVE-2026-26447 is a use-after-free vulnerability in Stomper commit 5e2741e, a STOMP protocol broker implementation. The flaw exists in the broker's subscription cleanup logic during StompClient destruction. When a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and then closes that connection, the broker performs incorrect cleanup of its internal subscription structures. This triggers a heap use-after-free, crashing the broker process. An unauthenticated remote client can reliably exploit this behavior to cause denial of service.

Critical Impact
An unauthenticated attacker can crash the Stomper broker by sending duplicate SUBSCRIBE commands and closing the connection, producing a reliable denial of service against all connected clients.

Affected Products

Stomper STOMP broker at commit 5e2741e
Downstream projects embedding the vulnerable Stomper revision
Deployments exposing the Stomper broker to untrusted network clients

Discovery Timeline

2026-08-26 - CVE-2026-26447 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-26447

Vulnerability Analysis

Stomper is an implementation of the Simple Text Oriented Messaging Protocol (STOMP) broker. The vulnerability resides in the code path that tears down a client session. When a client issues multiple SUBSCRIBE frames for the same destination on a single TCP connection, the broker registers duplicate or overlapping subscription records tied to the same StompClient instance.

Upon connection termination, the destructor walks the subscription list and releases the underlying heap objects. Because the subscription bookkeeping does not deduplicate references, the same heap object is freed and then dereferenced again during subsequent iterations. This dereference of freed memory constitutes a classic use-after-free [CWE-416], and the broker process crashes.

The issue does not require authentication. Any client able to establish a TCP session with the broker can drive the broker into the faulty cleanup path within milliseconds. Refer to the Stomper bug report for reproduction details.

Root Cause

The root cause is incorrect state management of subscription structures. The broker fails to detect that a client has already subscribed to a given destination on the same connection. Duplicate subscription entries share pointers to a single heap-allocated subscription object. During StompClient destruction, the cleanup routine frees the shared object on the first traversal and accesses it again on subsequent traversals.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker connects to the broker over TCP using STOMP. The attacker sends a CONNECT frame, followed by two or more SUBSCRIBE frames targeting the same destination, then closes the socket. The server-side destructor executes, triggering the use-after-free and crashing the broker. The attacker can loop this sequence to prevent the broker from serving any legitimate clients.

No verified public exploit code is available. The vulnerability mechanism is described in the Stomper vulnerability bug report.

Detection Methods for CVE-2026-26447

Indicators of Compromise

Repeated SUBSCRIBE frames from the same client identifier targeting an identical destination within a single session.
Abrupt Stomper broker process termination shortly after client disconnect events in service logs.
Crash signatures such as SIGSEGV or SIGABRT referencing subscription cleanup frames in core dumps.
Spikes in short-lived STOMP connections originating from a small number of source addresses.

Detection Strategies

Parse STOMP traffic to alert on multiple SUBSCRIBE frames for the same destination within one connection.
Monitor for repeated broker restarts and correlate with network sessions that closed immediately before the crash.
Inspect heap allocator diagnostics or AddressSanitizer output in non-production builds to confirm the use-after-free trigger.

Monitoring Recommendations

Enable process supervision to record exit codes and stack traces from the Stomper broker.
Log source IP, session duration, and frame counts for each STOMP connection.
Alert on availability regressions of the broker service through synthetic transaction monitoring.

How to Mitigate CVE-2026-26447

Immediate Actions Required

Restrict network access to the Stomper broker to trusted client networks using firewall rules or a service mesh.
Require mutual TLS or an authenticating reverse proxy in front of the broker to reject anonymous connections.
Deploy a process supervisor such as systemd or supervisord to automatically restart the broker after a crash while a fix is pending.
Review the upstream Stomper repository for a patched revision beyond commit 5e2741e.

Patch Information

No vendor patch reference is listed in the NVD entry at publication. Operators should track the Stomper project on GitHub for a fix that deduplicates subscription entries or hardens the StompClient destructor against double-free conditions. Rebuilding from a corrected revision is the durable remediation.

Workarounds

Terminate STOMP sessions at a protocol-aware gateway that filters duplicate SUBSCRIBE frames for the same destination on one connection.
Rate-limit inbound TCP connections to the broker port to slow denial-of-service attempts.
Isolate the broker on a dedicated host so that a crash does not degrade colocated services.
Run the broker under an automatic restart policy with backoff to preserve availability during exploitation attempts.

bash

# Example: restrict Stomper broker access with iptables and enable systemd auto-restart
iptables -A INPUT -p tcp --dport 61613 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 61613 -j DROP

# /etc/systemd/system/stomper.service
# [Service]
# ExecStart=/usr/local/bin/stomper
# Restart=always
# RestartSec=2s
systemctl daemon-reload
systemctl enable --now stomper.service