Executive brief
mqtt-packet is a JavaScript library used to parse MQTT protocol messages in IoT and messaging applications. A vulnerability allows attackers to crash applications by sending specially crafted sequences of MQTT packets, resulting in service unavailability and disruption of real-time communication systems.
Technical details
The vulnerability is a denial of service flaw (CWE-400) in mqtt-packet's packet parsing logic that can be triggered by specific sequences of MQTT protocol messages. The affected versions are 3.x prior to 3.4.6 and 4.x prior to 4.0.5. An unauthenticated network attacker can send malformed or specially crafted MQTT packets to cause the parser to crash, resulting in application termination. The fix is available in version 3.4.6 (3.x branch) and 4.0.5 (4.x branch).
Affected products
- mqtt-packet contributors mqtt-packet prior to 3.4.6; 4.0.0 prior to 4.0.5
Timeline
- 2019-02-18: disclosed