6.5

CVE-2026-30867

Exploit

CocoaMQTT: Denial of Service via Reachable Assertion in `PUBLISH` Packet Parsing

CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a vulnerability exists in the packet parsing logic of CocoaMQTT that allows an attacker (or a compromised/malicious MQTT broker) to remotely crash the host iOS/macOS/tvOS application. If an attacker publishes the 4-byte malformed payload to a shared topic with the RETAIN flag set to true, the MQTT broker will persist the payload. Any time a vulnerable client connects and subscribes to that topic, the broker will automatically push the malformed packet. The app will instantly crash in the background before the user can even interact with it. This effectively "bricks" the mobile application (a persistent DoS) until the retained message is manually wiped from the broker database. This issue has been patched in version 2.2.2.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Emqx ≫ Cocoamqtt SwPlatformswift Version < 2.2.2
   Apple ≫ iPhone OS Version-
   Apple ≫ macOS Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.234
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
security-advisories@github.com 5.7 2.1 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CWE-617 Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

https://github.com/emqx/CocoaMQTT/commit/010bca6f61b97d726252f61641d331a2bf82b338
Patch
https://github.com/emqx/CocoaMQTT/pull/659
Patch
Issue Tracking
https://github.com/emqx/CocoaMQTT/releases/tag/2.2.2
Release Notes
https://github.com/emqx/CocoaMQTT/security/advisories/GHSA-r3fr-7m74-q7g2
Vendor Advisory
Exploit