EUVD-2026-89171
GHSA-72x2-349w-qfqm
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated, but requires attacker positioning to deliver repeated malformed PUBLISH frames (AC:H); impact is availability-only pool exhaustion with no C/I effect.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
5DescriptionCVE.org
The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbound network traffic on the device until it is rebooted.
AnalysisAI
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can deliver a few dozen such messages exhaust the network driver's receive pool and halt all inbound traffic on the device until it is rebooted. Only builds including the NetX Duo MQTT client are exposed, and delivery requires broker control, a man-in-the-middle position on the MQTT session, or publish rights on a topic the client subscribes to, which is why the impact is availability-only (CVSS 4.0 base 8.2; assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) despite a network attack vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target device must run the Eclipse ThreadX NetX Duo MQTT client and be connected such that an attacker can deliver PUBLISH messages to it - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status is not confirmed from the available data - no exact fixed version is listed - so the primary action is to track and apply the remedy published in the Eclipse ThreadX NetX Duo advisory GHSA-9v23-qwp9-2q3h (https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9v23-qwp9-2q3h) and update to the patched NetX Duo release as soon as the vendor names it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all builds that include the Eclipse ThreadX NetX Duo MQTT client, confirm exposure, and restrict MQTT broker publish rights to trusted publishers; enforce TLS with mutual authentication to prevent man-in-the-middle delivery, and monitor device receive pools for exhaustion with automatic reboot/watchdog safeguards. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Moquette MQTT brokers running versions prior to 0.18.1 fail to enforce topic write ACLs on Last Will and Testament messa
An out-of-bounds write in the MQTT client module of the lwIP TCP/IP stack lets an adversary who controls or impersonates
Improper TLS hostname validation in the MQTT client layer of AWS IoT Device SDK for Python (AWSIoTPythonSDK) 1.5.3 throu
Remote unauthenticated clients can crash a Moquette MQTT broker running 0.18.0 or earlier by publishing or subscribing w
Hardcoded MQTT credentials shipped inside Bransys ELD grant unauthenticated read access to real-time telemetry for every
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or
The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client
Loopback source-address restriction bypass in RabbitMQ's native MQTT and MQTT-over-WebSocket listeners (all releases fro
Authorization bypass in RabbitMQ's MQTT topic permission handling allows a low-privileged authenticated user to broaden
Authenticated users of FlashMQ MQTT brokers running versions prior to 1.23.2 can cause a gradual memory leak by creating
NanoMQ MQTT brokers prior to 0.24.14 can be driven unresponsive by a remote unauthenticated client that sends MQTT v5 PU
The NanoMQ MQTT client (versions prior to 0.24.14) can be hung and driven into a CPU- and memory-consuming infinite loop
Same weakness CWE-401 – Memory Leak
View allShare
External POC / Exploit Code
Leaving vuln.today