CVE-2026-26445

Name of the Vulnerable Software and Affected Versions stomper version 5e2741e

Description A Denial of Service issue exists where a malicious client can send partial STOMP frames and maintain open TCP connections. This occurs because the broker utilizes edge-triggered epoll (EPOLLET) and MSG PEEK in the recv() function, leading sockets to enter a permanent half-read state. As these connections accumulate, the broker ceases to receive epoll events for those sockets and hangs in epoll wait(), preventing the processing of new messages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.