Description

MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth.

Remediation

References

https://github.com/mcollina/mosca/issues/393

https://github.com/mqttjs/mqtt-packet/pull/8

https://nodesecurity.io/advisories/75

Related Vulnerabilities

CVE-2017-16201 Vulnerability in npm package zjjserver

CVE-2023-0410 Vulnerability in npm package @builder.io/qwik

CVE-2019-17495 Vulnerability in maven package org.webjars.npm:swagger-ui

CVE-2020-17533 Vulnerability in maven package org.apache.accumulo:accumulo-core

CVE-2023-48223 Vulnerability in npm package fast-jwt

Severity

High

Classification

CWE-119 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Exploit Third Party Advisory