External risk intelligence

Stomper Use-After-Free Leads to Heap Corruption and Crash.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-26448

The vulnerability resides in a STOMP protocol broker, which is commonly deployed as a network-accessible middleware or message broker service. Such services are frequently exposed to network clients or edge-facing environments to facilitate message exchange, making it likely that the affected endpoint is reachable over a network in typical deployments.

Use After Free

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a message broker that handles network communication, potentially leading to a crash when specific sequences of client requests are processed. The issue arises from how the system manages memory for network streams, which could be exploited if not properly secured.

Memory error can crash message broker.
This is a critical security flaw.
Confirm if our systems use this broker.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by sending specially crafted network messages to a Stomper broker. Because the broker does not authenticate or restrict how clients send multiple CONNECT and SEND frames over the same TCP connection, an attacker can manipulate the timing of these frames. This manipulation can cause the broker to attempt to use data that has already been removed, leading to a crash.

Network access required.
Multiple CONNECT and SEND frames.
Broker process crash.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the availability and integrity of the Stomper message broker. When specific sequences of STOMP frames are sent, the broker may crash, potentially disrupting message processing services.

Broker availability and integrity
Broker crashes due to crafted frames
Service disruption for connected clients

Operational Fix

Recommended remediation, mitigation, and detection steps

System owners and platform teams are likely responsible for addressing this Stomper vulnerability. The first practical step is to identify all instances of the affected technology, determine their network reachability and business criticality, and then locate the accountable owner to plan remediation based on risk.

Identify affected technology owners.
Verify network exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Stomper and what is it used for?

Stomper is a software component designed to handle message brokering. It acts as middleware, allowing different applications to exchange information using the STOMP protocol. By managing communication channels and data flow, it facilitates real-time connectivity between services within a distributed architecture.

What is the Use-After-Free vulnerability in CVE-2026-26448?

This is a memory management error, specifically identified as CWE-416. It occurs when the software continues to use a memory address after that memory has been cleared or freed. In this case, the broker attempts to access data related to a network stream that no longer exists, which leads to instability and a process crash.

How can an attacker trigger this memory error?

An attacker triggers this by sending a specific, non-standard sequence of STOMP protocol frames over a single TCP connection. By sending multiple CONNECT frames followed by SEND frames to a previously subscribed destination, they manipulate the broker's memory state. Standard, single-frame message exchanges that do not involve these repetitive, overlapping sequences do not trigger this specific bug.

Is my system at risk if it runs Stomper?

Halo Surface Signal indicates this vulnerability is likely relevant if your Stomper instance is reachable over a network. Because the software is commonly used as middleware to bridge services, it is often placed in environments where it accepts connections from other clients. If your broker is configured to be internet-facing or accessible to untrusted network segments, it is at higher risk of interaction from unauthorized senders.

Do I need to take action to secure my environment?

Yes. Start by creating an inventory of all systems running Stomper to identify where it is deployed. Once identified, evaluate the network accessibility of each instance to determine if it is exposed to untrusted traffic. Finally, engage the relevant technical teams to prioritize these assets for remediation, focusing first on those that serve critical business functions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.