Description

Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client (or a later connection) sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a StompStreamSocket object that has already been freed. This results in a heap use-after-free and process crash. Because the protocol does not authenticate or restrict such sequences by default.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T20:17:11.767Z",
  "pubdate": "2026-08-26T20:17:11.767Z",
  "executiveSummary": "Stomper 5e2741e is susceptible to a critical Use-After-Free (UAF) vulnerability triggered by improper session management within the STOMP protocol implementation.\nThe vulnerability arises when a client transmits multiple CONNECT frames over a singular TCP connection, leading to the premature deallocation of the underlying StompStreamSocket object.\nSubsequent interaction with a destination previously associated with the freed object results in a dereferencing operation on invalid memory.\nThis flaw can be exploited by an unauthenticated remote attacker to cause a process crash, leading to a Denial-of-Service (DoS) condition.\nGiven that the protocol lacks inherent authentication or sequence validation, the attack vector is accessible to any entity capable of establishing a network connection to the broker.\nThe memory corruption characteristic of UAF vulnerabilities presents a significant security risk, as it may potentially facilitate arbitrary code execution depending on the state of the heap at the time of exploitation.",
  "technicalDetails": "The root cause of this vulnerability lies in the lifecycle management of the StompStreamSocket object within the Stomper broker. When a client initiates a TCP connection and issues multiple CONNECT frames, the broker logic fails to properly synchronize or invalidate existing session state before re-initializing or closing the socket handle.\nThe vulnerability manifests through the following attack flow: 1) An attacker establishes a TCP connection to the Stomper broker. 2) The attacker sends multiple CONNECT frames, which triggers internal logic that frees the memory associated with the initial StompStreamSocket object. 3) The object is deallocated; however, internal references to this object persist in the broker’s subscription or routing tables. 4) A subsequent SEND frame is sent, referencing the destination that was linked to the now-freed StompStreamSocket. 5) The broker attempts to access the stale memory pointer, leading to a heap-based Use-After-Free event.\nThe lack of protocol-level authentication or state sequence enforcement allows an attacker to manipulate the broker into a vulnerable state without requiring valid credentials or high-level privileges. Since the broker does not track the validity of the socket object once the connection state is toggled through multiple CONNECT operations, the dangling pointer remains active in the broker's memory space.\nThe impact of this Use-After-Free is a deterministic crash of the broker process, as dereferencing memory that has been reclaimed by the heap allocator typically triggers a segmentation fault or an access violation exception.\nIn highly complex heap environments, a sophisticated attacker might attempt to influence the heap layout—a technique often referred to as 'heap spraying' or 'heap grooming'—to populate the freed memory region with malicious data before the broker performs the invalid access. This could potentially allow the attacker to control the execution flow or overwrite critical object pointers, elevating the impact beyond a simple crash to potential remote code execution. Because Stomper handles these frames directly, the memory corruption occurs within the context of the broker service, meaning the attacker's actions are performed with the privileges of the service user."
}