An unauthenticated remote attacker can trigger a denial of service condition in Stomper 5e2741e by exploiting a heap use-after-free vulnerability during subscription cleanup.

The vulnerability is a heap use-after-free flaw triggered when an unauthenticated client repeatedly issues SUBSCRIBE commands and subsequently closes the connection. This incorrect cleanup of internal subscription structures during StompClient destruction leads to a process crash.

The primary impact of this vulnerability is a persistent denial of service, which can disrupt critical message brokering operations. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to service availability, potentially halting dependent applications that rely on the Stomper broker for communication.

Immediate Action: Monitor the vendor repository for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review application logs for patterns of rapid SUBSCRIBE commands followed by connection termination from suspicious or unknown clients.

Compensating Controls: Implement rate limiting on connection attempts and subscription requests at the network or application gateway level to mitigate the impact of automated exploitation attempts.

Public Exploit Available: Yes — a published proof-of-concept exists in the technical write-up referenced by the CVE record.

This vulnerability represents a significant risk to the stability of the Stomper message broker. Because the flaw can be triggered remotely without authentication, it is imperative that administrators track the official repository for a fix and prepare for immediate deployment to prevent service interruption.