CVE-2026-26445

Red Hat statement

A flaw was found in stomper. A remote unauthenticated attacker can cause a Denial of Service by sending partial STOMP frames over open TCP connections. When combined with the broker's use of edge-triggered epoll (EPOLLET) and MSG_PEEK in recv(), sockets enter a permanent half-read state. Once enough connections accumulate, the broker stops receiving epoll events for these sockets and hangs in epoll_wait, refusing new messages. Red Hat default security controls (e.g., non-root execution, process isolation) do not prevent this service-level socket starvation, though network boundaries can limit exposure.

Red Hat mitigation

Limit exposure by configuring network firewalls or security groups to restrict access to the STOMP broker port only to trusted clients. Alternatively, reduce the connection timeout and limit the maximum allowed unauthenticated TCP connections per host at the infrastructure or ingress layer.