CVE-2026-26449: Stomper Message Broker DOS Vulnerability

CVE-2026-26449 Overview

CVE-2026-26449 affects Stomper commit 5e2741e, an implementation of the Simple Text Oriented Messaging Protocol (STOMP). The server fails to validate the presence of the destination header when processing an inbound SEND frame. A client can send a malformed SEND frame that omits the required header, triggering a null pointer dereference or invalid memory access inside the frame handler. The result is a server process crash and a denial of service condition for all connected clients.

Critical Impact
An unauthenticated remote client can crash the Stomper broker with a single malformed STOMP SEND frame, disrupting messaging for all connected consumers and publishers.

Affected Products

Stomper STOMP server at commit 5e2741e
Applications embedding the affected Stomper code path for SEND frame handling
Deployments exposing the Stomper listener to untrusted clients

Discovery Timeline

2026-08-26 - CVE-2026-26449 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-26449

Vulnerability Analysis

STOMP is a text-based protocol where each frame includes a command, a set of header key-value pairs, and an optional body. The SEND command requires a destination header identifying the target queue or topic. Stomper's frame processing path reads the destination value directly from the parsed header map and passes it to downstream routing logic without checking whether the header exists. When the header is absent, the lookup returns a null value that is then dereferenced during message dispatch.

The issue maps to Null Pointer Dereference [CWE-476]. Because the crash occurs before any authentication or authorization decision is enforced, the attack surface includes any network client that can reach the STOMP listener.

Root Cause

The root cause is missing input validation on inbound STOMP frames. Stomper accepts the SEND command and proceeds to processing without verifying that mandatory headers defined by the STOMP specification are present. The absent destination header produces a null reference that the server subsequently reads or passes to a function that assumes a valid pointer.

Attack Vector

An attacker connects to the Stomper broker over TCP and completes the STOMP CONNECT handshake. The attacker then transmits a SEND frame that omits the destination header, ending the frame with the standard null terminator. Processing the frame triggers the crash. The frame requires no authentication credentials in default configurations and can be delivered with a few bytes over an established socket.

A proof of concept and detailed reproduction steps are published in the GitHub Vulnerability Report, and the affected source is available in the Stomper GitHub Repository.

Detection Methods for CVE-2026-26449

Indicators of Compromise

Unexpected termination of the Stomper server process, with restart entries in the service manager or process supervisor logs.
STOMP SEND frames received without a destination header, captured in packet captures or protocol-aware proxies.
Client connections that disconnect immediately after a single SEND frame is transmitted.

Detection Strategies

Deploy a network intrusion detection rule that inspects STOMP traffic on the broker port and flags SEND frames missing the destination: header line.
Correlate broker process crashes with preceding TCP sessions on the STOMP listener to identify the source client address.
Enable verbose frame logging in Stomper during triage to record the raw headers of frames that precede a crash.

Monitoring Recommendations

Alert on repeated restarts of the Stomper service within short time windows using host telemetry.
Track connection counts and abrupt session terminations from single source IPs against the STOMP port.
Forward broker logs and host process events to a central analytics tier for cross-referencing crash timestamps with network activity.

How to Mitigate CVE-2026-26449

Immediate Actions Required

Restrict network access to the Stomper listener so that only trusted application clients can reach the port.
Place the broker behind an authenticating reverse proxy or a protocol-aware gateway that rejects SEND frames lacking a destination header.
Run the Stomper process under a supervisor that restarts it automatically to shorten outage duration until a fix is applied.

Patch Information

No vendor patch is referenced in the CVE record at publication. Users should monitor the upstream Stomper GitHub Repository for a fix that adds validation for required STOMP headers, and rebuild from source once a corrected commit is available. Applying a local patch that returns an ERROR frame and closes the connection when destination is missing is a viable interim remediation.

Workarounds

Add an input filter in front of Stomper that parses STOMP frames and drops any SEND frame missing the destination header.
Disable anonymous access to the broker and require authenticated STOMP sessions from known application accounts.
Segment the broker into a restricted network zone with firewall rules limiting inbound connections to application servers only.

bash

# Example iptables rule limiting STOMP access to a trusted application subnet
iptables -A INPUT -p tcp --dport 61613 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 61613 -j DROP