A critical heap use-after-free vulnerability in Stomper 5e2741e allows unauthenticated attackers to trigger a process crash or potentially execute arbitrary code.

The vulnerability is a heap use-after-free flaw triggered when a StompStreamSocket object is dereferenced after being freed during specific sequences of CONNECT and SEND frames. The issue is reachable by unauthenticated attackers due to the lack of default authentication or sequence restrictions in the protocol.

The exploitation of this vulnerability poses a severe risk to service availability and system integrity. With a CVSS score of 9.8, the potential for remote code execution or consistent service disruption could lead to significant operational downtime and the compromise of sensitive data processed by the broker.

Immediate Action: Since no specific patch version is currently identified, administrators should restrict network access to the Stomper service to trusted IP addresses and monitor for unusual frame sequences.

Proactive Monitoring: Review system and application logs for frequent service crashes or unexpected restarts that may indicate attempted exploitation of the use-after-free condition.

Compensating Controls: Implement a Network Intrusion Detection System (NIDS) or a similar traffic analysis tool to identify and block malformed or repetitive Stomp protocol frames that deviate from standard communication patterns.

Public Exploit Available: Yes, a published proof-of-concept exists in the researcher write-up referenced by the CVE record.

Given the critical nature of this heap use-after-free vulnerability, organizations should treat this as a high priority. Because a public proof-of-concept is available, the barrier to entry for an attacker is low. It is imperative to limit exposure of the affected service to the public internet and coordinate with the vendor or upstream project for an official security update to resolve this memory corruption issue.