The vulnerability involves a STOMP broker using the stomper library, where a malicious client can send incomplete STOMP frames that cause the broker’s use of edge‑triggered epoll and MSG_PEEK in recv() to trap sockets in a permanent half‑read state. This state leads to sockets not generating further epoll events, and when enough such sockets accumulate the broker hangs in epoll_wait, ceasing to process new messages, resulting in a denial of service that can render the broker inoperable for all clients. Based on the description, it is inferred that the attacker must maintain a persistent network connection to the broker to exploit the half‑read state.

The affected systems are STOMP brokers that incorporate the stomper component, specifically the version identified as 5e2741e. No vendor or product names are listed in the CNA data, so any STOMP broker implementing this code submodule is potentially vulnerable. Versions prior to any fixes in newer stomper releases are at risk. The likely impacted deployments are those that have not applied the latest release.

The risk is high with a CVSS score of 7.5 and an EPSS score of < 1 %; a malicious client can hold partial STOMP frames to force sockets into a permanent half‑read state, causing a denial of service that prevents the broker from processing new messages. The exploit is likely to be remote, delivered over the network to the broker’s listening port. Although the broker is not listed in CISA KEV, the lack of mitigation could still lead to widespread outages when the vulnerable code runs.