CVE-2026-26447 Use after free in n/a
An unauthenticated attacker can crash the Stomp broker by repeatedly subscribing and disconnecting, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-26447?
CVE-2026-26447 is a high-severity use after free vulnerability in n/a, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and then closes that connection, the broker performs incorrect cleanup of its internal subscription structures. This results in a heap use-after-free during StompClient destruction, causing the broker process to crash. An unauthenticated client can exploit this to reliably trigger a denial of service.
Weakness: CWE-416
Which versions are affected by CVE-2026-26447?
How do I fix CVE-2026-26447?
No fix has been published for CVE-2026-26447 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-26447 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26447 exists.
Sources
Also known as GHSA-3h57-jwg8-vm79, UBUNTU-CVE-2026-26447.