Description

MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth.

Remediation

References

https://github.com/mcollina/mosca/issues/393

https://github.com/mqttjs/mqtt-packet/pull/8

https://nodesecurity.io/advisories/75

Related Vulnerabilities

CVE-2017-16159 Vulnerability in npm package caolilinode

CVE-2021-32859 Vulnerability in npm package baremetrics-calendar

CVE-2021-32640 Vulnerability in npm package ws

CVE-2015-3337 Vulnerability in maven package org.elasticsearch:elasticsearch

CVE-2020-7738 Vulnerability in npm package shiba

Severity

High

Classification

CWE-119 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Exploit Third Party Advisory