Stomper version 5e2741e contains a use‑after‑free flaw that allows a client to crash the broker. When a user sends multiple CONNECT frames over the same TCP socket and later another client sends SEND frames to a previously subscribed destination, the broker may dereference a pointer to a StompStreamSocket object that has already been freed. This results in a heap use‑after‑free and a process crash. Because the STOMP protocol lacks default authentication or restriction for such sequences, an unauthenticated attacker can trigger the crash, leading to denial of service.

The affected product is the Stomper messaging broker, specifically the 5e2741e revision. No vendor name is publicly listed; the application is deployed in environments that use the Stomp protocol for messaging.

The vulnerability is not listed in the CISA KEV catalog, and no EPSS score is available, so the documented exploitation probability is unknown. Nevertheless, an unauthenticated remote client can induce a crash with a single TCP connection, making the risk high for availability. While the description does not report arbitrary code execution, a heap corruption could be leveraged by a sophisticated attacker if additional conditions are met. Brokers running Stomper should consider the risk as moderate to high, particularly in production environments where uninterrupted messaging is critical.