CVE-2026-26448: Use After Free
Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client (or a later connection) sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a StompStreamSocket object that has already been freed. This results in a heap use-after-free and process crash. Because the protocol does not authenticate or restrict such sequences by default.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the crash?
Any client able to connect to the broker can trigger the vulnerable frame sequence, because the protocol does not authenticate or restrict these sequences by default.
What interaction is required to exploit the issue?
An attacker sends multiple CONNECT frames on one TCP connection. A subsequent SEND frame from another client or a later connection to a destination previously subscribed on that connection can cause the broker to dereference the freed object and crash.
What is the observable impact?
The reported impact is a heap use-after-free that crashes the broker process.