CVE-2026-26448: Stomper Use-After-Free Vulnerability

CVE-2026-26448 Overview

CVE-2026-26448 is a use-after-free vulnerability in Stomper commit 5e2741e, an implementation of the Simple Text Oriented Messaging Protocol (STOMP) broker. The broker dereferences a freed StompStreamSocket pointer when clients send multiple CONNECT frames on the same TCP connection and subsequent SEND frames target destinations previously subscribed on that connection. Exploitation produces a heap use-after-free and crashes the broker process. The STOMP protocol does not authenticate or restrict such frame sequences by default, so any client that can connect to the broker can trigger the flaw.

Critical Impact
Remote unauthenticated clients can crash the Stomper broker by sending crafted STOMP frame sequences, producing denial of service.

Affected Products

Stomper STOMP broker at commit 5e2741e
Deployments built directly from the upstream Stomper GitHub repository
Applications embedding the vulnerable broker code as a messaging component

Discovery Timeline

2026-08-26 - CVE-2026-26448 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-26448

Vulnerability Analysis

The flaw is a heap use-after-free [CWE-416] in the Stomper broker's connection and subscription handling. STOMP is a text-based messaging protocol where clients establish a session with a CONNECT frame, subscribe to destinations, and exchange messages via SEND frames. Stomper tracks each session using a StompStreamSocket object allocated on the heap.

When a client transmits more than one CONNECT frame on the same TCP connection, the broker's state machine drops or replaces the prior session object without clearing every reference held by subscription tables. Subscriptions registered by the earlier CONNECT continue to point at the freed StompStreamSocket. A later SEND frame from another client, addressed to one of those destinations, causes the broker to dereference the dangling pointer while delivering the message.

Root Cause

The root cause is a lifetime management defect between session state and subscription state. Freeing the StompStreamSocket on a duplicate CONNECT does not invalidate the subscription entries that reference it. The broker treats subscription lookups as safe indirections, so the freed memory is read and written during message dispatch.

Attack Vector

An attacker needs network access to the broker's STOMP listener. The exploit sequence is: connect via TCP, send two or more CONNECT frames, and issue a SUBSCRIBE to a chosen destination. A second connection then sends a SEND frame to that destination, forcing the broker to dispatch through the freed pointer and crash. Because STOMP applies no authentication by default, exploitation requires no credentials. Full technical steps are documented in the Stomper vulnerability report.

// No verified exploit code is published for this CVE.
// See the linked vulnerability report for the frame sequence used to reproduce the crash.

Detection Methods for CVE-2026-26448

Indicators of Compromise

Unexpected termination or segmentation faults of the Stomper broker process, especially with heap corruption signatures in core dumps
STOMP sessions containing more than one CONNECT frame on a single TCP connection
Broker log gaps or connection resets correlated with SEND frames targeting recently disconnected subscribers

Detection Strategies

Inspect STOMP traffic at the network layer and alert on repeated CONNECT frames within one TCP session, which is non-conformant client behavior
Run the broker under a heap sanitizer such as AddressSanitizer in test environments to surface the use-after-free with a precise stack trace
Correlate broker crash events with recent client source addresses to identify the triggering peer

Monitoring Recommendations

Monitor broker process uptime and restart counts, treating rapid restarts as a high-priority signal
Capture packet traces on the STOMP listener port to preserve frame sequences for forensic review
Forward broker stderr and crash logs to a central logging pipeline for retention and analysis

How to Mitigate CVE-2026-26448

Immediate Actions Required

Restrict network access to the Stomper broker so only trusted clients can reach the STOMP port
Terminate or block clients that send duplicate CONNECT frames on a single TCP session
Deploy the broker behind a reverse proxy or firewall that can enforce STOMP frame validation

Patch Information

No vendor patch is referenced in the NVD entry for Stomper commit 5e2741e at the time of publication. Track the upstream Stomper repository for fixes that invalidate subscription references when a session object is freed. Rebuild and redeploy the broker once a corrected commit is available.

Workarounds

Front the broker with a STOMP-aware proxy that rejects multiple CONNECT frames per TCP connection
Require mutual TLS or an authenticating gateway in front of the broker to limit exposure to unauthenticated peers
Isolate the broker in a dedicated process with automatic restart supervision to limit downtime from crash-based denial of service

bash

# Example: restrict access to the STOMP port (default 61613) to a trusted subnet
iptables -A INPUT -p tcp --dport 61613 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 61613 -j DROP