Stomper processes STOMP frames and, when a client sends a SEND frame without the required destination header, the server dereferences a null pointer. This causes an invalid memory access that crashes the process, leading to a loss of availability for the affected service. The weakness is a null pointer dereference, identified as CWE‑476.

The known vulnerable code exists in the open‑source Stomper server, specifically in revision 5e2741e and earlier builds that do not enforce the presence of the destination header in a SEND frame. No formal vendor is assigned; the project is typically deployed in environments that handle STOMP messaging.

The CVSS vector gives a score of 7.5, signifying a severe impact for availability. The EPSS score is less than 1 %, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that an attacker could trigger the crash from any external client able to send a malformed SEND frame, implying a remote attack vector over the STOMP network protocol. The vulnerability does not provide privilege escalation or data disclosure, so the risk is limited to service disruption.