EUVD-2026-30692
GHSA-48p2-hcwr-rx4q
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in EMQX up to 6.2.0. This affects an unknown function of the file apps/emqx/src/emqx_persistent_session_ds.erl of the component QoS 2 PUBLISH Packet Handler. Such manipulation leads to race condition. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
AnalysisAI
Race condition in EMQX MQTT broker versions up to 6.2.0 allows authenticated remote attackers to cause limited availability impact through malformed QoS 2 PUBLISH packet handling in persistent sessions. The vulnerability exploits timing windows in the emqx_persistent_session_ds.erl module, though successful exploitation is marked as difficult with high attack complexity. A proof-of-concept exploit is publicly available on GitHub (Pathfind-tama/Report_EMQX_MQTT), demonstrating QoS 2 message duplication attacks. CVSS 3.1, exploitability requires low-privilege authentication and precise timing, limiting real-world risk despite public POC.
Technical ContextAI
EMQX is an open-source MQTT broker written in Erlang/OTP, commonly deployed for IoT message routing and pub-sub architectures. This vulnerability affects the persistent session storage module (emqx_persistent_session_ds.erl) which manages durable MQTT connections and message delivery guarantees. The root cause is CWE-362 (concurrent execution using shared resource with improper synchronization), occurring during QoS 2 (exactly-once delivery) message acknowledgment flows. QoS 2 uses a four-step handshake (PUBLISH → PUBREC → PUBREL → PUBCOMP), and the race condition exploits timing windows in state transitions within persistent session data structures. Erlang's lightweight process model may create scenarios where concurrent message handlers access shared session state without proper locking, leading to inconsistent delivery tracking or resource exhaustion.
RemediationAI
Primary mitigation is upgrading to EMQX version newer than 6.2.0 if a patched release exists - consult EMQ Technologies security advisories at emqx.io/security or GitHub releases github.com/emqx/emqx/releases for confirmed fix version, as vendor patch status is not independently verified in provided data. If immediate patching is not feasible, implement these compensating controls: (1) Restrict MQTT client authentication to trusted entities only, removing shared credentials or open registration that could allow malicious authenticated access (PR:L requirement means auth is mandatory for exploitation). (2) Disable persistent sessions (clean_session=true / Clean Start=1) for non-critical clients to bypass the vulnerable emqx_persistent_session_ds.erl code path, though this sacrifices message durability guarantees. (3) Rate-limit QoS 2 PUBLISH messages per client using EMQX's built-in quota management to reduce race condition trigger opportunities, accepting potential degradation of legitimate high-throughput QoS 2 flows. (4) Monitor broker resource utilization and session state anomalies to detect exploitation attempts. Reference the detailed POC at github.com/Pathfind-tama/Report_EMQX_MQTT for attack signatures to inform detection rules.
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today