Executive brief
tinyMQTT is a lightweight broker used for communication between IoT devices. A flaw in how it handles invalid connection requests allows an attacker to repeatedly open connections without the server properly closing them. This can lead to a total service outage as the server runs out of memory and available connection slots, preventing legitimate devices from communicating.
Technical details
A vulnerability exists in tinyMQTT's parse_connect_packet function due to improper handling of MQTT v3.1.1 protocol violations. When a client sends a CONNECT packet with a zero-length Client ID and the CleanSession flag set to 0, the broker correctly identifies the error and returns a CONNACK 0x02 (Identifier Rejected) code. However, it fails to explicitly close the underlying TCP connection. Because the connection teardown logic is not guaranteed to execute following this specific error return, the socket remains open. An unauthenticated remote attacker can exploit this by repeatedly sending malformed CONNECT packets to exhaust file descriptors and memory, resulting in a Denial of Service (DoS).
Affected products
- JustDoIt0910 tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962
Timeline
- 2024-02-18: other: Vulnerable commit date
- 2025-07-14: disclosed: Issue reported on GitHub
- 2026-05-18: advisory: CVE published by NVD