PT-2026-3628 · Tinymqtt · Tinymqtt

Published 2026-01-20 · Updated 2026-02-03 · CVE-2025-56353

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions tinyMQTT versions prior to commit 6226ade15bd4f97be2d196352e64dd10937c1962

Description A memory leak exists because the broker does not validate or reject malformed UTF-8 strings in topic filters. An attacker can exploit this by sending repeated subscription requests with large or invalid filter payloads. Each request allocates memory for the malformed topic filter, but the broker does not release this memory, resulting in increasing heap usage and potential denial of service with sustained attacks.

Recommendations Update to commit 6226ade15bd4f97be2d196352e64dd10937c1962 or a later version.

Fix

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2025-56353

Affected Products

Tinymqtt

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-56353 · Security Note
• https://osv.dev/vulnerability/CVE-2025-56353 · Vendor Advisory
• https://github.com/JustDoIt0910/tinyMQTT/issues/19 · Note
• https://twitter.com/VulmonFeeds/status/2013718519301406853 · Twitter Post
• https://t.me/cveNotify/150792 · Telegram Post
• https://t.me/cveNotify/149400 · Telegram Post
• https://twitter.com/CVEnew/status/2013650054377099377 · Twitter Post