CVE-2026-26445

Received Received - Intake

stomper Denial of Service via Partial STOMP Frames

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: MITRE

Description

stomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames and keep the TCP connections open, which, combined with the broker s use of edge-triggered epoll (EPOLLET) and MSG_PEEK in recv(), causes sockets to enter a permanent half-read state. When enough such connections accumulate, the broker stops receiving any further epoll events for those sockets and eventually hangs in epoll_wait, effectively refusing to process new messages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-26445

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a Denial of Service issue in the stomper library. A malicious client can send incomplete STOMP frames and keep TCP connections open. Due to the broker using edge-triggered epoll and MSG_PEEK in recv(), sockets enter a permanent half-read state. This causes the broker to stop receiving epoll events for those sockets and eventually hang in epoll_wait, refusing to process new messages.

Detection Guidance

Check for excessive half-open TCP connections using netstat or ss commands. Look for connections stuck in a half-read state with the STOMP protocol. Monitor epoll_wait hang conditions in broker logs or system calls.

Impact Analysis

This vulnerability can cause your STOMP broker to become unresponsive or crash, leading to service disruptions. It may result in message processing delays, system hangs, or complete unavailability of messaging services, affecting applications relying on STOMP for communication.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by disrupting the availability of systems handling sensitive data. A Denial of Service condition may lead to unauthorized access delays or service interruptions, which could violate requirements for timely data access or processing under these regulations.

Mitigation Strategies

Update stomper to a patched version that handles partial STOMP frames properly and avoids the half-read state issue with epoll and MSG_PEEK.

Hi! I’m here to help you understand CVE-2026-26445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70