CVE-2026-26449: Null Pointer Dereference
Published Aug 26, 2026
·Updated
In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference (or access to invalid memory) while processing the frame, causing the process to crash.
Affected Software
1 affected component
Stomper 5e2741e=5e2741e
Event History
Aug 26, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:17 PM
Description
Frequently Asked Questions
1
What access does an attacker need to trigger the issue?
An attacker needs to be able to act as a client and send a malformed SEND frame to the Stomper server. The frame must omit the destination header field.
2
Which deployments are exposed?
Stomper 5e2741e deployments that process client-supplied SEND frames are exposed to the crash condition when they receive a SEND frame without a destination header.