High [CVE-2026-26448] Denial of Service via Use-After-Free
This high-severity Red Hat Linux advisory covers CVE-2026-26448.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client (or a later connection) sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a StompStreamSocket object that has already been freed.
This results in a heap use-after-free and process crash. Because the protocol does not authenticate or restrict such sequences by default.
A flaw was found in Stomper. A remote attacker can trigger a use-after-free vulnerability by sending multiple CONNECT frames on the same TCP connection, followed by SEND frames to a previously subscribed destination.
This sequence causes the broker to dereference a freed StompStreamSocket object, triggering a heap corruption and crashing the broker process. Red Hat default security controls (such as process isolation and non-root execution boundaries) constrain the issue to a Denial of Service against the messaging daemon, preventing arbitrary code execution.
Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-825.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Restrict access to the STOMP message broker port using firewall rules or network security groups to allow traffic only from authorized, trusted IP addresses. Where supported by network boundaries or ingress control layers, enforce strict limits on repeated frame sequences and connection lifetimes per host.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.