CVE-2026-26448

Deferred Deferred - Pending Action

Heap Use-After-Free in Stomper 5e2741e Broker

Publication date: 2026-08-26

Last updated on: 2026-08-27

Assigner: MITRE

Description

Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client (or a later connection) sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a StompStreamSocket object that has already been freed. This results in a heap use-after-free and process crash. Because the protocol does not authenticate or restrict such sequences by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-27

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-26448

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a Use-After-Free issue in Stomper 5e2741e. When multiple CONNECT frames are sent on the same TCP connection and another client sends SEND frames to a previously subscribed destination, the broker may access a freed StompStreamSocket object. This causes a heap use-after-free and leads to a process crash.

Impact Analysis

This vulnerability can cause service disruption by crashing the broker process. It may lead to denial of service if the broker becomes unavailable, affecting message delivery for all connected clients.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other standards as it is a technical flaw in the Stomper protocol implementation. However, if exploited, it could lead to service disruption or crashes, potentially impacting data availability and integrity, which are key considerations under GDPR and HIPAA.

Mitigation Strategies

Update Stomper to a patched version that fixes the Use-After-Free issue in handling CONNECT and SEND frames. Ensure protocol authentication and restrictions are enabled to prevent unauthorized sequences.

Hi! I’m here to help you understand CVE-2026-26448. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70