Executive brief
The mqtt-packet library, used by MQTT brokers to decode incoming MQTT protocol messages, contains a buffer over-read vulnerability that allows a remote attacker to crash MQTT broker services by sending a specially crafted MQTT Subscribe packet. This results in denial of service to messaging infrastructure and dependent applications.
Technical details
The vulnerability is a buffer over-read (CWE-125, CWE-126) caused by improper input validation when decoding MQTT Subscribe packets. An attacker can send a malformed MQTT Subscribe packet over the network to any MQTT broker using the vulnerable mqtt-packet library versions. Upon receipt, the library attempts to parse the packet without proper bounds checking, leading to a buffer over-read and immediate crash. The vulnerability affects versions prior to 3.5.1, versions 4.0.0–4.1.2, versions 5.0.0–5.6.0, and versions 6.0.0–6.1.1. Patched versions are available (3.5.1, 4.1.3, 5.6.1, and 6.1.2).
Affected products
- mqtt-packet (npm) mqtt-packet before 3.5.1, 4.0.0–4.1.2, 5.0.0–5.6.0, 6.0.0–6.1.1
Timeline
- 2019-05-06: disclosed
- 2019-05-14: advisory