Executive brief
EMQX is an open-source MQTT broker used to connect and manage large numbers of IoT devices. A flaw in how the broker handles high-priority messages (QoS 2) can lead to a race condition where messages are delivered more than once, despite a protocol guarantee of 'exactly once' delivery. In practice, this could result in duplicate business transactions, such as double-processing a payment or repeating a command to an industrial device, potentially corrupting application state or causing operational errors.
Technical details
A race condition exists in the QoS 2 PUBLISH packet handler within 'apps/emqx/src/emqx_persistent_session_ds.erl'. The broker publishes messages to subscribers before the PacketId is committed to persistent storage. Because the state commit is handled asynchronously via a timer ('ensure_state_commit_timer'), a broker crash or client reconnection occurring before the timer fires results in the PacketId not being persisted. Upon reconnection, a client retransmission of the same PacketId is treated as a new message, leading to duplicate delivery. This vulnerability affects EMQX versions up to 6.2.0 when using persistent sessions (DS storage). While the vendor has acknowledged the behavior, there is currently no official fix timeline, and users are advised to implement application-level deduplication.
Affected products
- EMQX EMQX up to 6.2.0
Timeline
- 2026-05-17: disclosed: Public disclosure of the vulnerability and exploit details.
- 2026-05-17: advisory: NVD and VulDB published the advisory.