The Stomper broker is vulnerable to a use‑after‑free condition that occurs when a client repeatedly sends SUBSCRIBE commands for the same destination on a single connection and then closes that connection. The broker’s cleanup logic fails to correctly free internal subscription structures, leading to a heap use‑after‑free during the destruction of the client object. An unauthenticated attacker can trigger this flaw systematically to crash the broker process, resulting in a denial of service. The weakness is a classic use‑after‑free that compromises the integrity and availability of the broker.

The affected product is the Stomper broker, version 5e2741e. Vendor information is not disclosed in the advisory. No other products or versions are identified.

This vulnerability can be exploited remotely by any network user that can communicate with the broker, as it does not require authentication. The exploit reliably causes the broker to terminate, providing a simple denial‑of‑service attack vector. No CVSS score is supplied and the EPSS is not available, but the lack of an authentication requirement suggests a high likelihood of exploitation for exposed brokers. The vulnerability is not listed in the CISA KEV database.