CVE-2026-26448

Description

A flaw was found in Stomper. A remote attacker can trigger a use-after-free vulnerability by sending multiple CONNECT frames on the same TCP connection, followed by SEND frames to a previously subscribed destination. This can cause the broker to dereference a freed memory region, leading to a heap use-after-free and a process crash, resulting in a Denial of Service (DoS).

Statement

A heap use-after-free flaw was found in Stomper. A remote, unauthenticated attacker can exploit this by issuing multiple CONNECT frames on a single TCP connection, followed by SEND frames directed to a previously subscribed destination. This sequence causes the broker to dereference a freed StompStreamSocket object, triggering a heap corruption and crashing the broker process. Red Hat default security controls (such as process isolation and non-root execution boundaries) constrain the issue to a Denial of Service against the messaging daemon, preventing arbitrary code execution.

Mitigation

Restrict access to the STOMP message broker port using firewall rules or network security groups to allow traffic only from authorized, trusted IP addresses. Where supported by network boundaries or ingress control layers, enforce strict limits on repeated frame sequences and connection lifetimes per host.

Understanding the Weakness (CWE)

CWE-825

Confidentiality

Technical Impact: Read Memory

If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.

Availability

Technical Impact: DoS: Crash, Exit, or Restart

If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.

Integrity,Confidentiality,Availability

Technical Impact: Execute Unauthorized Code or Commands

If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.