What is the CVSS score of CVE-2025-63235?

CVE-2025-63235 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of sol MQTT Broker are affected by CVE-2025-63235?

The sol MQTT broker contains an unauthenticated resource exhaustion vulnerability (CVE-2025-63235) enabling remote attackers to trigger denial-of-service through flooding with malformed CONNECT…

How to fix or mitigate CVE-2025-63235?

Within 24 hours: conduct an inventory of all sol MQTT broker instances at commit 373d848 or earlier, restrict network access to CONNECT traffic from authorized hosts only using firewall rules, and enable real-time alerting on memory and file descriptor consumption. Within 7 days: deploy connection rate limiting on CONNECT packets (e.g., max 100 attempts per second per source IP) using an upstream proxy or application gateway, implement mandatory client authentication in front of the broker to filter unauthenticated connections before they reach the vulnerable service, and establish automated restart procedures triggered at 80% resource utilization. Within 30 days: contact sol MQTT broker vendor for patch release timeline and interim security updates, evaluate migration to alternative MQTT brokers (e.g., Mosquitto, EMQX) if vendor commits to patch beyond 60 days, and document resilience architecture changes required by network segmentation workarounds.

sol MQTT Broker CVE-2025-63235

EUVD-2025-210649 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-07 mitre

GHSA-cc3w-v57m-93mp

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-accessible MQTT service requires no authentication or privileges; only availability is impacted through deterministic resource exhaustion with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 21:26 vuln.today

CVE Published

Aug 07, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Aug 07, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK but fail to close the session or deallocate internal resources. This behavior allows an attacker to create numerous half-open connections that consume memory and file descriptors indefinitely, potentially triggering the Linux OOM killer and causing a denial of service.

AnalysisAI

Resource exhaustion in the sol MQTT broker (commit 373d848, 2024-12-12) allows unauthenticated remote attackers to cause a denial of service by flooding the service with malformed or duplicate CONNECT packets. The broker's session teardown logic is incomplete: failed or repeated CONNECT attempts silently drop the connection without releasing internal state, leaving memory and file descriptors allocated indefinitely. With no authentication required and the attack confirmed automatable per SSVC, a sustained flood of crafted CONNECT packets can exhaust system resources and trigger the Linux OOM killer. No public exploit code was formally released as a tool, but a POC is referenced in the linked GitHub advisory; the vulnerability has not been added to the CISA KEV catalog.

Technical ContextAI

sol is a lightweight, open-source MQTT broker written in C, targeting Linux environments. MQTT's protocol handshake begins with a CONNECT packet from the client, to which the broker responds with a CONNACK. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause: the broker allocates session state and file descriptors upon receiving a CONNECT but does not free those resources when the handshake fails - whether due to malformed packet data or repeated authentication failures. Each failed CONNECT thus leaks a file descriptor and heap-allocated session memory. Since Linux systems enforce per-process file descriptor limits (typically 1024 to 65535 open files), and heap exhaustion triggers the kernel OOM killer, this flaw provides a reliable, unauthenticated path to service termination. The CPE provided (cpe:2.3:a:n/a:n/a) is uninformative; the affected artifact is the codepr/sol GitHub repository at the specific commit 373d848.

RemediationAI

No vendor-released patched version has been identified at time of analysis; the upstream fix status should be tracked via the GitHub issue at https://github.com/codepr/sol/issues/12. Organizations running sol should immediately apply a network-layer rate limit on CONNECT packets to the MQTT port (default TCP/1883 or TCP/8883 for TLS), using iptables or nftables rules such as connection rate limiting per source IP - this reduces but does not eliminate the attack surface, as a distributed source could still exhaust resources. Restricting access to the MQTT broker port to known client IP ranges via firewall ACL is the most effective compensating control and effectively eliminates external exploitation, though it may conflict with IoT or cloud-based client architectures. Monitoring file descriptor usage of the broker process (via /proc/PID/fd) and setting an OS-level process memory cap (systemd MemoryMax or cgroups v2) can limit blast radius and prevent full-system OOM events, but will not prevent the broker itself from being disrupted. If sol is not in active required use, disabling the service until a patched commit is verified is the lowest-risk option.