A client can send a SEND frame to a Stomper instance that omits the required destination header field. The server attempts to use this missing header, leading to a null pointer dereference and causing the process to crash. The primary impact is a loss of availability for the affected service, as it stops accepting further frames until restarted. The weakness involves the use of an uninitialized or null references during parsing, reflecting a classic null pointer dereference vulnerability.

This vulnerability affects the open‑source Stomper server, specifically version 5e2741e and earlier builds that lack lenient input validation for the SEND frame. No vendor appears to be officially assigned for this product, and the product is typically deployed in environments that process STOMP messaging frames.

The CVSS score for this issue is not publicly disclosed, and no EPSS value is available, so the exact exploitation likelihood cannot be quantified. However, the crash can be triggered by any client able to send a malformed SEND frame, indicating that the attack vector is likely remote over the STOMP network protocol. The server would need to be reachable and the client must be able to target the specific listening port. Because the flaw causes a service‑disruption rather than privilege escalation or data theft, the risk is largely confined to availability. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation at this time, but it remains actionable for service disruption.