PT-2026-41677 · Tinymqtt · Tinymqtt

Published 2026-05-18 · Updated 2026-05-18 · CVE-2025-56352

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions tinyMQTT (affected versions not specified)

Description The broker mishandles protocol violations during the parsing of CONNECT packets. When a CONNECT packet is received with a zero-length Client ID and CleanSession is set to 0, the broker returns a CONNACK return code 0x02 (Identifier Rejected) but does not close the TCP connection. Because the connection teardown logic is not guaranteed to execute, each invalid attempt leaves the underlying socket open. This can lead to server-side resource exhaustion through the accumulation of memory and file descriptors, potentially resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-56352

Affected Products

Tinymqtt

References · 4

• 🔥❌ https://github.com/user-attachments/files/21207896/Resource_Exhaustion_Poc.txt · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2025-56352 · Security Note
• https://github.com/JustDoIt0910/tinyMQTT/issues/19 · Note
• https://t.me/CVEtracker/54136 · Telegram Post