CVE-2026-30867

MEDIUM EPSS 23.6%
Published Apr 2, 20262mo ago · Modified Jun 17, 20261w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Apr 2, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a vulnerability exists in the packet parsing logic of CocoaMQTT that allows an attacker (or a compromised/malicious MQTT broker) to remotely crash the host iOS/macOS/tvOS application. If an attacker publishes the 4-byte malformed payload to a shared topic with the RETAIN flag set to true, the MQTT broker will persist the payload. Any time a vulnerable client connects and subscribes to that topic, the broker will automatically push the malformed packet. The app will instantly crash in the background before the user can even interact with it. This effectively "bricks" the mobile application (a persistent DoS) until the retained message is manually wiped from the broker database. This issue has been patched in version 2.2.2.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
23.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-617

Affected Products 3

VendorProductVersionRange
emqxcocoamqtt* <2.2.2
appleiphone_os*any
applemacos*any

References 4

  • github.com https://github.com/emqx/CocoaMQTT/commit/010bca6f61b97d726252f61641d331a2bf82b338
    Patch
  • github.com https://github.com/emqx/CocoaMQTT/pull/659
    Issue TrackingPatch
  • github.com https://github.com/emqx/CocoaMQTT/releases/tag/2.2.2
    Release Notes
  • github.com https://github.com/emqx/CocoaMQTT/security/advisories/GHSA-r3fr-7m74-q7g2
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/emqx/CocoaMQTT/commit/010bca6f61b97d726252f61641d331a2bf82b338
    Patch
  • github.com https://github.com/emqx/CocoaMQTT/pull/659
    Issue TrackingPatch