Vulnerability · Published Aug 26, 2026 · Assigned by mitre
CVE-2026-26445
High 7.5
In plain English
A high-severity resource allocation without limits in the stomper package (Ubuntu). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
stomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames and keep the TCP connections open, which, combined with the broker s use of edge-triggered epoll (EPOLLET) and MSG_PEEK in recv(), causes sockets to enter a permanent half-read state. When enough such connections accumulate, the broker stops receiving any further epoll events for those sockets and eventually hangs in epoll_wait, effectively refusing to process new messages.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | stomper | no fix listed | UBUNTU-CVE-2026-26445 |
| Ubuntu:24.04:LTS | stomper | no fix listed | UBUNTU-CVE-2026-26445 |
| Ubuntu:26.04:LTS | stomper | no fix listed | UBUNTU-CVE-2026-26445 |
| Ubuntu:26.10 | stomper | no fix listed | UBUNTU-CVE-2026-26445 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H