CVE-2026-30867: CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a vulnerability…
CVE-2026-30867 · Severity: medium · CVSS 5.7 · Published 2026-04-02
CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a vulnerability exists in the packet parsing logic of CocoaMQTT that allows an attacker (or a compromised/malicious MQTT broker) to remotely crash the host iOS/macOS/tvOS application. If an attacker publishes the 4-byte malformed payload to a shared topic with the RETAIN flag set to true, the MQTT broker will persist the payload. Any time a vulnerable client connects and subscribes to that topic, the broker will automatically push the malformed packet. The app will instantly crash in the background before the user can even interact with it. This effectively "bricks" the mobile application (a persistent DoS) until the retained message is manually wiped from the broker database. This issue has been patched in version 2.2.2.
No. Junglewise Threat Intelligence has no report of CVE-2026-30867 being exploited in the wild.
How severe is CVE-2026-30867?
Medium severity, with a CVSS score of 5.7, published 2 April 2026.
Which products and versions are affected?
Apple Iphone Os, Apple macOS, EMQX Cocoamqtt. The advisory does not name versions.
Is there a fix for CVE-2026-30867?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-30867?
Check whether you run Apple Iphone Os, Apple macOS or EMQX Cocoamqtt. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.