CVE-2026-26448: n/a

CVE-2026-26448 describes a use-after-free vulnerability in Stomper 5e2741e. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client or connection sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a StompStreamSocket object that has already been freed. This results in a heap use-after-free condition leading to process crash. The protocol does not authenticate or restrict such sequences by default, increasing the risk of exploitation. The vulnerability is identified as CWE-416 (Use After Free) and has a CVSS v3.1 score of 9.8, indicating critical severity.

Successful exploitation can cause a heap use-after-free condition resulting in a broker process crash. The vulnerability impacts confidentiality, integrity, and availability (all rated high in CVSS), potentially allowing denial of service. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, consider restricting or authenticating client connections to prevent unauthorized or malformed CONNECT and SEND frame sequences that trigger the vulnerability.