The Stomper broker contains a flaw that causes the server process to terminate when it receives a SIGPIPE signal, which occurs when data is sent to a TCP connection that has already been closed by the peer. The bug allows an unauthenticated attacker to trigger the crash by closing the socket at specific times, leading to an immediate denial of service. The weakness is rooted in improper signal handling within the broker’s network code, resulting in a fatal process exit.

The vulnerability affects any deployment of the Stomper broker that includes the commit identified as 5e2741e. No vendor or product tree is listed in the advisory; however, any system running this exact build of Stomper is potentially exposed. Since no additional versioning information is provided, users should verify whether their copy matches or predates this commit.

The attack vector is remote over the network protocol that Stomper serves; any client capable of sending STOMP frames or closing a transport socket can provoke the crash. The CVSS score of 7.5 and an EPSS score of < 1% indicate moderate to high severity but a low likelihood of exploitation. The existence of a straightforward, unauthenticated trigger indicates a high likelihood of exploitation if the broker is exposed to untrusted traffic or lacks network segmentation. KEV status is not listed in CISA KEV, so no public exploitation evidence is currently known, but the ease of triggering suggests the risk to availability is significant.