CVE-2026-26447

Name of the Vulnerable Software and Affected Versions Stomper version 5e2741e

Description A Use-After-Free issue exists where the broker performs incorrect cleanup of internal subscription structures. This occurs when a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and subsequently closes that connection. The flaw leads to a heap use-after-free during StompClient destruction, allowing an unauthenticated client to trigger a denial of service by crashing the broker process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.