CVE-2026-26446: Stomper vulnerability
Stomper 5e2741e is vulnerable to Denial of Service. When a broker sends data to a client whose TCP connection was already closed by the peer, the server process receives SIGPIPE and immediately terminates, resulting in a denial of service. Any unauthenticated client can trigger the crash by closing the socket at specific points.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated client that can connect to the broker can trigger the crash. No authentication is required.
What conditions are required to trigger the denial of service?
The broker must send data after the client peer has already closed its TCP connection. An attacker can close the socket at specific points to cause the server process to receive SIGPIPE and terminate.
How can I tell whether an instance is affected?
An affected server process terminates immediately after receiving SIGPIPE while sending data to a client whose TCP connection has been closed. The reported affected Stomper revision is 5e2741e.